Zerlyer

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** Broken access control exists in the organization management API. A scoped API key using the `limited to orgs` scope inherits the permissions of its owner-user, enabling destructive actions across different organizations. This occurs when a user with administrative privileges in multiple organizations creates a write-mode API key restricted to a single organization; the key can still execute destructive operations against other organizations. The issue stems from the route-level authorization function `rbac check permission direct()`, which prioritizes the owner's user privileges over the API key's `limited to orgs` scope. Affected API endpoints include 'DELETE /organization' and 'DELETE /organization/members'. **Recommendations** Update to version 12.128.2.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An authorization bypass exists in the 'POST /private/role bindings' endpoint. The system fails to verify the ownership of the `app id` during the creation of app-scoped role bindings. This allows an attacker with administrative privileges in one organization to create role bindings for applications owned by other organizations, leading to unauthorized reading and modification of those applications. **Recommendations** Update to version 12.128.2 or later. As a temporary workaround, restrict access to the 'POST /private/role bindings' endpoint to minimize the risk of exploitation.