Executive brief
Capgo, a platform for managing app updates and webhooks, contained a security flaw where restricted API keys could perform actions beyond their intended limits. Specifically, an API key restricted to a single application could be used to trigger organization-wide webhook tests, potentially interacting with downstream systems or exposing delivery metadata. This bypasses the security boundaries intended to isolate different applications within the same organization.
Technical details
A scope isolation vulnerability exists in Capgo's webhook testing functionality due to incorrect authorization logic in the `apikeyHasOrgRight()` function. The `POST /webhooks/test` endpoint fails to enforce the `limited_to_apps` restriction when validating API keys, only checking if the key has organization-level rights or if `limited_to_orgs` is empty. An authenticated attacker with a low-privileged, app-scoped API key can bypass these checks to trigger signed outbound webhook deliveries for any webhook within their organization. This allows for unauthorized interaction with downstream integrations and access to delivery metadata. The issue is addressed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-07-12: disclosed: NVD publication date