CVE-2026-100628

Katalog CVE

CVSS 4.3 · Medium EPSS 0,20%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app_id but omit org_id, limited_to_orgs, and expires_at resolve the target app and scope the key to it, but never add the app's owner organization to the list of organization IDs passed to validateExpirationAgainstOrgPolicies; because that list is empty, the validation returns early. As a result, an authenticated organization member can create a non-expiring app-scoped API key even when the owning organization has require_apikey_expiration enabled and a max_apikey_expiration_days limit configured. The issue is fixed in version 12.128.12.

Rincian

Terbit di NVD

26 September 2026

Terakhir diubah

28 September 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Cap-go/capgo.app/security/advisories/GHSA-j6p6-qqcg-3fwp
• https://www.vulncheck.com/advisories/capgo-app-before-12.128.12-authentication-bypass-via-apikey