CVE-2026-100628 Details
Description
capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app_id but omit org_id, limited_to_orgs, and expires_at resolve the target app and scope the key to it, but never add the app's owner organization to the list of organization IDs passed to validateExpirationAgainstOrgPolicies; because that list is empty, the validation returns early. As a result, an authenticated organization member can create a non-expiring app-scoped API key even when the owning organization has require_apikey_expiration enabled and a max_apikey_expiration_days limit configured. The issue is fixed in version 12.128.12.
A vulnerability exists in capgo.app versions prior to 12.128.12, allowing authenticated organization members to bypass API key expiration policies when creating app-scoped API keys. The issue arises in the POST /apikey endpoint, where requests can omit critical organization-related parameters. This oversight prevents the application from validating expiration requirements against the organization's policies, leading to the creation of non-expiring API keys. This vulnerability undermines key management controls, as the generated keys remain valid indefinitely unless manually revoked.
Users can update to capgo.app version 12.128.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-j6p6-qqcg-3fwp | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-j6p6-qqcg-3fwp | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/capgo-app-before-12.128.12-authentication-bypass-via-apikey | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cap-go capgo.app | < 12.128.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |