Privilege Escalation Vulnerability in Cap-go's API Key Management

CVE-2026-100615

What is CVE-2026-100615?

The Cap-go capgo.app prior to version 12.267.1 exhibits a serious vulnerability in its API key rotation mechanism. This flaw allows users with apikey_manager privileges to manipulate the system in a dangerous manner by enumerating API keys that belong to the same owner. An attacker can rotate a higher-privileged sibling API key, specifically that of an org_super_admin, and gain access to its plaintext credential. By exploiting the PUT endpoint, the attacker can obtain a replacement plaintext secret, effectively granting them unauthorized authentication as a higher-privileged user. This vulnerability poses significant risks to organizations relying on Cap-go's platform for secure API management.

References