PT-2026-51778 · Cap Go · Cap-Go
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Cap-go versions prior to 12.128.2
Description
An authorization bypass exists in the 'GET /organization/members' endpoint. This issue allows API keys restricted to specific organizations to bypass
limited to orgs restrictions, enabling attackers to read membership data from organizations outside their assigned scope. The exposed data includes uid, email, image url, role, and is tmp.Recommendations
Update Cap-go to version 12.128.2 or later.
Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go