CVE-2026-56246 Details

A broken access control vulnerability has been identified in the Capgo organization management API, prior to version 12.128.2. This vulnerability allows a scoped API key, limited to specific organizations, to inherit the permissions of its owner-user. As a result, it can perform destructive actions across organizations. For instance, if a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still execute harmful operations, such as deleting organization data or members, in another organization. The issue arises from a flaw in route-level authorization, which fails to properly enforce the API key's organizational limitations before applying the owner's user privileges, enabling unauthorized cross-organization actions.

For API-key-authenticated requests, enforce organizational scopes before accepting user-based permission successes. Additionally, add explicit organization-scope checks on destructive organization routes that currently rely solely on general permission checks.