Executive brief
Capgo, a platform for managing app updates and API keys, contains a security flaw in how it handles restricted API subkeys. By sending specially crafted headers in a web request, an attacker can trick the system into ignoring subkey restrictions and instead granting the full permissions of the main account API key. This allows a user who should have limited access to perform actions or view data they are not authorized to see.
Technical details
A weak parsing vulnerability exists in Capgo's 'middlewareKey' function within 'hono_middleware.ts'. The application uses 'Number(headerValue)' to parse the 'x-limited-key-id' header and only applies subkey restrictions if the resulting value is truthy. Attackers can provide malformed strings, the value '0', or duplicate headers (which some proxies join with commas) to produce 'NaN' or other falsy values. Because these values are falsy, the application skips the subkey enforcement logic and defaults to the broader permissions of the primary API key. This allows an authenticated remote attacker to bypass intended 'whitelabel' or limited-scope restrictions. The issue is resolved in version 12.128.2 by implementing strict integer validation and explicit null checks.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD