Capgo CVE-2026-100615

Requires an authenticated principal already holding the apikey_manager role within the target org, and the existence of a higher-privileged sibling API key (e.g. org_super_admin) under the same owner. Exploitation is performed through the API key rotation (PUT) endpoint, which fails to validate the target key's privilege against the caller's and returns the rotated key's plaintext secret. Limiting factors: the attacker must possess or compromise an apikey_manager key (not unauthenticated despite the vendor PR:N), and a stronger same-owner sibling key must exist to escalate to; deployments must be running a version before 12.267.1.

This is a genuine, high-value privilege-escalation flaw whose real-world risk depends on holding the apikey_manager role. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) rates it 8.7, but PR:N is inconsistent with the description, which explicitly requires an attacker already holding the apikey_manager role - this is authenticated abuse, not unauthenticated, so the network/no-privilege signal overstates exposure. Conversely, the vendor's VI:N/VA:N understates impact: recovering the plaintext credential of an org_super_admin key yields full administrative control (read, write and availability over the org), so integrity and availability impact are real. There is no EPSS score, no CISA KEV listing, and no public POC, so there is no evidence of active or automatable exploitation; combined with the requirement for a pre-existing privileged role, this is a targeted insider/compromised-lower-role escalation path rather than a mass-exploited internet-wide bug. Net: a real priority for any org that provisions apikey_manager keys, but the raw 8.7 with PR:N flatters the true unauthenticated risk - treat it as a serious authenticated privilege boundary failure.

An attacker holding an apikey_manager API key (or who has compromised one) enumerates the sibling API keys belonging to the same owner, identifies a higher-privileged org_super_admin key, and calls the PUT rotation endpoint against it. Because rotation does not check the target key's privilege relative to the caller, the server returns the new plaintext secret, which the attacker then uses to authenticate as org_super_admin. No public exploit code has been identified, but the technique is straightforward to reproduce from the advisory.