CVE-2026-88862

Name of the Vulnerable Software and Affected Versions Capgo backend versions prior to 12.242.5

Description The backend fails to validate parent-child delegation when processing the x-limited-key-id header. The function checkKeyByIdPg() in supabase/functions/ backend/utils/hono middleware.ts resolves the numeric API key ID using only the key ID, expiration state, and the authenticating key's user id. Simultaneously, hasLimitedRbacSubkeyScope() accepts any key with a non-organization RBAC binding, and validateSubkeyUser() only compares owning user IDs. This allows an authenticated apikey manager API key without application access to provide the numeric ID of a more privileged key owned by the same user. The middleware then uses setSubkeyAuthContext to replace the authenticated principal and secret with that of the privileged key, enabling the user to exercise app admin permissions without knowing the secret.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.