EUVD-2026-38739Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API call with a low-privileged subkey, no user interaction, and full cross-tenant read/write/availability impact yields PR:L with H/H/H impacts.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.
AnalysisAI
Authorization bypass in Capgo before 12.128.2 allows authenticated users with valid subkeys to escape scope restrictions by supplying their own subkey identifier in the x-limited-key-id header, causing middlewareKey to fall back to the unrestricted parent key. With CVSS 4.0 of 8.7 and high impact across confidentiality, integrity, and availability, exploitation only requires low-privileged API access, though no public exploit identified at time of analysis.
Technical ContextAI
Capgo is a Capacitor-based live-update and over-the-air mobile deployment platform whose HTTP API uses a middlewareKey function to authorize requests and apply per-key scoping via limited_to_orgs and limited_to_apps constraints attached to subkeys. The flaw is a classic CWE-863 (Incorrect Authorization): the middleware accepts the x-limited-key-id header to identify which subkey context to honor, but fails to validate that the chosen subkey's scope restrictions are actually applied downstream. When the lookup falls back to the parent API key, all org/app boundaries that the subkey was meant to enforce are silently dropped, so downstream route handlers see a fully privileged caller.
RemediationAI
Vendor-released patch: Capgo 12.128.2 - upgrade self-hosted instances to 12.128.2 or later as the primary remediation, following the GitHub Security Advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-2h89-vcvx-5pvh. Where immediate upgrade is not possible, strip or reject the x-limited-key-id header at an upstream reverse proxy or WAF so that middlewareKey cannot honor caller-supplied subkey identifiers (this disables any legitimate use of scoped subkeys for affected tenants), and rotate any subkeys that may have been used to probe the endpoint. As a longer-term compensating control, audit API access logs for cross-org/cross-app activity originating from low-privileged subkeys and revoke subkeys that show unexpected scope, accepting that the audit only catches abuse retrospectively.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today