PT-2026-51767 · Cap Go · Cap-Go

Judel777 · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-56232

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Capgo before 12.128.2 fails to enforce limited to orgs and limited to apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-56232

Affected Products

Cap-Go

References · 3

• 🔥 https://github.com/Cap-go/capgo/security/advisories/GHSA-2h89-vcvx-5pvh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56232 · Security Note
• https://vulncheck.com/advisories/capgo-subkey-scope-bypass-in-middlewarekey-via-x-limited-key-id-header · Note