CVE-2026-56232CWE-863

Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header

High · published June 24, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00469 · 39.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-06-24T11:53Z
EPSS history
Timeline
  • 24 JUN 11:53Z
    Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header
    cvelistv5