Is CVE-2026-100628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100628 being exploited in the wild.

How severe is CVE-2026-100628?

Medium severity, with a CVSS score of 4.3, published 26 September 2026.

Is there a fix for CVE-2026-100628?

A patch was published on 2026-09-26: version 12.128.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100628 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-100628?

Check whether you run Cap-go Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100628: Capgo app-scoped API key creation bypasses organization expiration policy

CVE-2026-100628 · Severity: medium · CVSS 4.3 · Published 2026-09-26

Capgo is a mobile app deployment and updates platform used by development teams to manage app releases. An authenticated organization member can create API keys that never expire, even when the organization has mandatory expiration policies configured, by creating app-scoped keys instead of organization-scoped ones. This allows an insider to establish persistent, hard-to-audit access to the API that bypasses security controls the organization explicitly enabled.

Technologies: Cap-go Capgo. Vendors: Cap-go.

Quick answers

Is CVE-2026-100628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100628 being exploited in the wild.
How severe is CVE-2026-100628?: Medium severity, with a CVSS score of 4.3, published 26 September 2026.
Which products and versions are affected?: Cap-go Capgo before 12.128.12.
Is there a fix for CVE-2026-100628?: A patch was published on 2026-09-26: version 12.128.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100628 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-100628?: Check whether you run Cap-go Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The POST /apikey endpoint fails to add an app's owner organization to the list of organization IDs validated against expiration policies when creating app-scoped keys. When requests supply app_id but omit org_id and limited_to_orgs, the app is resolved and the key is scoped to it, but the validation function receives an empty organization list and returns early without enforcing the organization's require_apikey_expiration and max_apikey_expiration_days policies. An authenticated organization member can exploit this by issuing a POST request with only app_id and name parameters to create a permanent API key.

Affected products

Cap-go capgo before 12.128.12

Timeline

2026-09-26: disclosed
2026-09-26: patched: version 12.128.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.