PT-2026-51767 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-56232

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Capgo before 12.128.2 fails to enforce limited to orgs and limited to apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-56232

Produtos afetados

Cap-Go

Referências · 2

• https://github.com/Cap-go/capgo/security/advisories/GHSA-2h89-vcvx-5pvh · Aviso do Fabricante
• https://vulncheck.com/advisories/capgo-subkey-scope-bypass-in-middlewarekey-via-x-limited-key-id-header · Nota