Which versions of Capgo are affected by CVE-2026-56246?

Capgo before version 12.128.2 is vulnerable to cross-organization authorization bypass where scoped API keys inherit full administrative privileges of their owner, enabling destructive operations…. A patch is available.

How to fix or mitigate CVE-2026-56246?

24 hours: Inventory all Capgo API keys; immediately rotate or revoke scoped API keys (limited_to_orgs parameter) with administrative privileges. 7 days: Search API audit logs for unauthorized cross-organization administrative operations; assess scope of potential unauthorized access; notify affected stakeholders. 30 days: Upgrade Capgo to version 12.128.2 or later; validate authorization enforcement and key-scope boundaries through comprehensive testing.

Capgo CVE-2026-56246

Q: What is the CVSS score of CVE-2026-56246?

CVE-2026-56246 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42249 HIGH

Improper Authorization (CWE-285)

2026-07-08 disclosure@vulncheck.com

GHSA-46rc-2xqj-534f

Authentication Bypass

7.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network API reachable with a valid low-privilege API key (PR:L) and no interaction; destructive DELETE actions give high integrity and availability impact but no data disclosure (C:N), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 15:01 EUVD

Analysis Generated

Jul 08, 2026 - 14:44 vuln.today

DescriptionCVE.org

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope.

AnalysisAI

Cross-organization authorization bypass in Capgo before 12.128.2 lets a scoped API key (limited_to_orgs) inherit its owner's full user permissions, so an admin holding a write key restricted to one organization can execute destructive operations against a different organization. Because route-level authorization (rbac_check_permission_direct) checks the owner's user privileges before enforcing the key's org scope, a key intended to be confined to Org A can call DELETE /organization or DELETE /organization/members on Org B. No public exploit has been identified at time of analysis; the flaw is documented in a GitHub Security Advisory (GHSA-ccm4-hf72-p28m) and a VulnCheck advisory.

Technical ContextAI

Capgo is a live/over-the-air (OTA) update platform for Capacitor mobile applications, and this flaw resides in its organization management REST API. The affected mechanism is Capgo's scoped API key feature (limited_to_orgs), which is meant to bind a key to a specific organization boundary. The root cause is CWE-285 (Improper Authorization): the authorization middleware rbac_check_permission_direct resolves and evaluates the key owner's underlying user-level RBAC privileges first, and does not subsequently intersect those privileges with the key's limited_to_orgs scope. As a result the scope restriction is effectively cosmetic - the token is authorized as broadly as the human account behind it. This is a classic confused-deputy / privilege-inheritance pattern where a capability meant to attenuate authority instead carries the full authority of its issuer.

RemediationAI

Vendor-released patch: upgrade to Capgo 12.128.2 or later, which enforces the API key's limited_to_orgs scope in the authorization path rather than deferring solely to the owner's user privileges. Until the upgrade is applied, compensating controls include revoking or rotating any write-mode scoped API keys held by users who are admins in more than one organization (the exact precondition for exploitation), and where feasible avoiding assigning a single human account admin rights across multiple organizations so a compromised or misused key cannot cross tenants; note this may disrupt legitimate multi-org administrators. As an additional interim measure, monitor and/or restrict access to the destructive organization-management endpoints (DELETE /organization and DELETE /organization/members) and alert on cross-organization DELETE calls, accepting that this adds operational monitoring overhead. Refer to the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-ccm4-hf72-p28m and the VulnCheck advisory at https://www.vulncheck.com/advisories/capgo-cross-organization-authorization-bypass-via-scoped-api-key-privilege-inheritance for authoritative guidance.