Executive brief
Capgo, an app management and deployment platform, suffered from a security flaw in how it handles API keys restricted to specific organizations. If a user managed multiple organizations, an API key intended for only one of those organizations could be used to perform destructive actions—such as deleting images or removing member roles—in another organization. This could lead to unauthorized data loss or disruption of service for affected business accounts.
Technical details
A broken access control vulnerability exists in Capgo's organization management API due to improper privilege inheritance. The root cause is located in the route-level authorization function `rbac_check_permission_direct`, which evaluates the API key owner's user privileges before enforcing the key's `limited_to_orgs` scope. An attacker with administrative access to two organizations can create a write-mode API key restricted to one organization and use it to perform destructive operations (such as `DELETE /organization` or `DELETE /organization/members`) against the other. While Row Level Security (RLS) may block some database writes, certain service-role operations (like image deletion and RBAC role stripping) occur before or outside the RLS scope, leading to successful unauthorized state changes. The issue is fixed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: NVD publication date