EUVD-2026-38750Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint (AV:N), no special conditions (AC:L), requires a valid API key (PR:L), and impact is limited to partial confidentiality of membership metadata (C:L) with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limited_to_orgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, image_url, role, and is_tmp from organizations outside their assigned scope.
AnalysisAI
Authorization bypass in Capgo (cap-go before 12.128.2) allows holders of org-limited API keys to read membership data from organizations outside their assigned scope by calling the GET /organization/members endpoint without proper enforcement of limited_to_orgs restrictions. Exposed fields include uid, email, image_url, role, and is_tmp - sufficient to enumerate organization membership and email addresses across tenants. No public exploit identified at time of analysis; CVSS 4.0 scores this at 5.3 reflecting a low-privilege, network-accessible attack with limited confidentiality impact.
Technical ContextAI
Capgo is a live-update delivery platform for Capacitor-based mobile applications, providing an API through which organizations manage app deployments and team membership. The affected component is the REST endpoint GET /organization/members. API keys issued in Capgo can carry a limited_to_orgs scope intended to restrict which organizations the key may access. CWE-285 (Improper Authorization) is the root cause: the server-side authorization logic does not validate that the requesting API key's limited_to_orgs list actually includes the target organization ID supplied in the request, allowing any org-limited key to query any organization. The CPE cpe:2.3:a:cap-go:capgo:*:*:*:*:*:*:*:* covers all versions prior to the fix.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the authorization bypass by correctly enforcing limited_to_orgs scope checks on the GET /organization/members endpoint. The vendor advisory is available at https://github.com/Cap-go/capgo/security/advisories/GHSA-q7xv-p34q-v365 and VulnCheck coverage at https://www.vulncheck.com/advisories/cap-go-authorization-bypass-in-organization-members-endpoint-via-api-key-scope-bypass. If an immediate upgrade is not feasible, a compensating control for self-hosted deployments is to restrict network-level access to the API to trusted IP ranges, which limits the pool of potential abusers but does not eliminate the flaw for authorized API key holders. Additionally, auditing API key issuance to identify any org-limited keys that should not exist and revoking unnecessary keys reduces the attack surface until patching is complete. There are no reported side effects from upgrading to 12.128.2.
Improper access control in Capgo (capgo.app) lets any holder of an ordinary full API key forge a trusted SSO provider by
Authorization bypass in Capgo (capgo.app), a live-update/OTA platform for Capacitor mobile apps, allows a de-provisioned
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Privilege escalation in the Capgo (capgo.app) backend through version 12.242.4 allows an authenticated API key holder to
Capgo's MFA enforcement is defeated by an authentication assurance level (AAL) mismatch across two distinct code paths:
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an exte
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today