CVE-2026-56246

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Broken access control exists in the organization management API. A scoped API key using the limited to orgs scope inherits the permissions of its owner-user, enabling destructive actions across different organizations. This occurs when a user with administrative privileges in multiple organizations creates a write-mode API key restricted to a single organization; the key can still execute destructive operations against other organizations. The issue stems from the route-level authorization function rbac check permission direct(), which prioritizes the owner's user privileges over the API key's limited to orgs scope. Affected API endpoints include 'DELETE /organization' and 'DELETE /organization/members'.

Recommendations Update to version 12.128.2.