API Key Management Flaw in Capgo App

CVE-2026-100628

What is CVE-2026-100628?

A vulnerability exists in the Capgo App that allows authenticated organization members to create non-expiring app-scoped API keys. This occurs when certain parameters, such as org_id and expires_at, are omitted during API key creation. Although the organization has an expiration policy in place, the failure to properly validate against the organization's policies lets members generate keys without expiration, thereby circumventing enforced security measures. This flaw was addressed in version 12.128.12, enhancing the API key management process and enforcing key expiration policies.

References