Capgo CVE-2026-56225

Requires a valid Capgo public API key created with mode=all and constrained via limited_to_apps to at least one application on a multi-app account; the attacker must invoke the API key management endpoints (get/put/delete/post handlers) over the network. Exploitation is limited to accounts that host more than one app under the same organization and that have provisioned app-scoped mode=all keys to less-trusted parties - single-app tenants, accounts using narrowly-moded keys, and self-hosted deployments without external key holders have no realistic exposure. No user interaction is required and no additional vulnerability chaining is needed once a qualifying key is held.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) is internally consistent with the description: exploitation is remote, low-complexity, requires only a low-privilege scoped API key, and yields high confidentiality and integrity impact on sibling credentials with limited availability impact. There is no CISA KEV listing, no public POC, and no EPSS score supplied, so real-world exploitation pressure cannot be quantified - risk is best understood as a credible insider/tenant-isolation threat rather than mass-scanned RCE. Risk is highest for multi-app Capgo tenants that provision per-app keys to third parties or CI systems, since any such party gains de facto account-level key administration; single-app deployments are largely unaffected in practice.

A third-party developer or CI pipeline is issued a Capgo API key with mode=all but limited_to_apps set to a single non-production application. Using that key against the public API key-management endpoints, the holder lists sibling API keys belonging to the same account's production app, then rotates or deletes them - locking out the legitimate owner or substituting attacker-controlled credentials for subsequent OTA update operations.