CVE-2026-56246

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope.

• CWE-285

• https://github.com/Cap-go/capgo/security/advisories/GHSA-ccm4-hf72-p28m
• https://www.vulncheck.com/advisories/capgo-cross-organization-authorization-bypass-via-scoped-api-key-privilege-inheritance
• https://github.com/Cap-go/capgo/security/advisories/GHSA-ccm4-hf72-p28m

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56240Capgo before 12.128.12 contains a billing authorization bypa…5.3
• CVE-2026-56241Capgo before 12.128.2 contains a privilege escalation vulner…8.3
• CVE-2026-56242Capgo before 12.128.2 contains an unauthenticated security d…8.7
• CVE-2026-56243Capgo before 12.128.2 contains a security control bypass vul…8.6
• CVE-2026-56244Capgo before 12.128.2 allows non-admin API keys to read webh…7.1
• CVE-2026-56245Supabase Capgo before 12.128.2 contains an authorization byp…8.8
• CVE-2026-56247Capgo before 12.128.2 allows org admins to assign org-scoped…8.8
• CVE-2026-56248Cap-go capgo (capgo-backend) before 12.128.12 contains an un…8.7
• CVE-2026-56249Capgo before 12.128.2 contains an authorization bypass vulne…7.6
• CVE-2026-5625A weakness has been identified in assafelovic gpt-researcher…4.3
• CVE-2026-56250Capgo before 12.128.2 allows upload-scoped API keys to modif…8.7
• CVE-2026-56251Capgo before 12.128.2 contains a broken row level security p…7