CVE-2026-56225

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authorization bypass exists in the public API key management handlers ('get', 'put', 'delete', 'post'). API keys configured with mode=all but restricted to a single application via limited to apps are only validated against limited to orgs and not limited to apps. This allows an app-scoped key to enumerate, update, and delete other API keys within the same account that are outside its designated application scope, leading to the potential tampering of account-level credentials.

Recommendations Update to version 12.128.2 or later.