Executive brief
Capgo is a mobile app deployment and updates platform used by development teams to manage app releases. An authenticated organization member can create API keys that never expire, even when the organization has mandatory expiration policies configured, by creating app-scoped keys instead of organization-scoped ones. This allows an insider to establish persistent, hard-to-audit access to the API that bypasses security controls the organization explicitly enabled.
Technical details
The POST /apikey endpoint fails to add an app's owner organization to the list of organization IDs validated against expiration policies when creating app-scoped keys. When requests supply app_id but omit org_id and limited_to_orgs, the app is resolved and the key is scoped to it, but the validation function receives an empty organization list and returns early without enforcing the organization's require_apikey_expiration and max_apikey_expiration_days policies. An authenticated organization member can exploit this by issuing a POST request with only app_id and name parameters to create a permanent API key.
Affected products
- Cap-go capgo before 12.128.12
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: version 12.128.12