Executive brief
Capgo, a platform for managing app updates and webhooks, contains a security flaw where certain organizational security policies are not strictly enforced. Specifically, even if an organization requires all API keys to have an expiration date for security reasons, older non-expiring keys can still be used to manage webhooks. This allows an attacker with a legacy key to create, list, or delete webhooks, potentially disrupting automated workflows or intercepting data notifications despite the organization's attempt to disable such keys.
Technical details
An authorization bypass exists in Capgo's webhook management endpoints due to improper policy enforcement in the 'checkWebhookPermission' function. While the platform allows organizations to enable a 'require_apikey_expiration' policy, the webhook-related code fails to call the 'apikeyHasOrgRightWithPolicy' helper, which is responsible for verifying if a key meets expiration requirements. Consequently, an authenticated attacker possessing a legacy non-expiring API key can successfully perform GET, POST, and DELETE operations on webhooks even when the organizational policy should explicitly block such keys. This vulnerability was addressed in version 12.128.2 by ensuring the permission check correctly validates the API key against organizational policies.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-20: disclosed: NVD publication date