CVE-2026-100615 in Capgo App
Summary
by MITRE • 09/26/2026
Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as the higher-privileged principal.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Cap-go versions prior to 12.267.1 represents a critical failure in access control logic within the application's API key management subsystem. This flaw specifically affects the mechanism used for rotating or updating existing API keys, which is intended to be a routine administrative function for maintaining security hygiene by regularly refreshing credentials. The core technical deficiency lies in the server-side validation process during this rotation operation. When an authenticated user with the apikey_manager role initiates a request to update an API key via the PUT endpoint, the application fails to adequately verify that the requesting principal possesses sufficient privileges relative to the target resource being modified. Instead of strictly enforcing ownership and privilege boundaries, the system allows the requester to specify any valid API key identifier associated with their owner account, regardless of the role or permission level assigned to that specific key. This lack of strict authorization checks creates a direct path for privilege escalation within the application's identity management framework.
From an operational perspective, this vulnerability enables an attacker who has compromised or been granted the apikey_manager role to perform unauthorized actions against higher-privileged entities sharing the same owner account. The attack sequence typically begins with enumeration, where the attacker identifies other API keys belonging to the same organizational unit or user profile. By leveraging the PUT endpoint designed for key rotation, the attacker selects a target key that holds elevated privileges, such as an org_super_admin role which grants broad administrative capabilities across the platform. Upon submitting the update request, the system generates a new secret credential and returns it in plaintext within the response body. This behavior is particularly dangerous because API keys are often treated with high security expectations, yet their rotation mechanism inadvertently exposes them to interception by lower-privileged actors. The attacker can then immediately utilize this recovered plaintext secret to authenticate as the higher-privileged principal, effectively bypassing role-based access controls and gaining unauthorized administrative access.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, specifically in the context of failing to enforce proper authorization checks during state-changing operations. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as well as sub-techniques related to Account Manipulation and Persistence through API key abuse. The ability to rotate a sibling key with higher privileges allows the attacker to establish persistent access that is difficult to detect using standard monitoring tools, as the activity appears as legitimate administrative work performed by an authorized manager role. The impact extends beyond simple data exposure; it compromises the integrity of the entire authentication and authorization model for the affected organization, potentially leading to full system compromise depending on the scope of permissions held by the targeted org_super_admin key.
Mitigation strategies must focus on immediate patching and enhanced access control validation. Organizations running Cap-go versions before 12.267.1 should upgrade to the latest stable release where this logic has been corrected to enforce strict ownership verification and privilege level checks during API key rotation requests. In addition to upgrading, administrators should implement rigorous monitoring of apikey_manager activities, particularly looking for unusual patterns in PUT requests targeting high-privilege keys. Implementing multi-factor authentication for administrative roles can also mitigate the risk of credential theft resulting from this flaw. Security teams should review their current API key distribution policies to ensure that least privilege principles are strictly applied, minimizing the number of super-admin level keys and reducing the potential blast radius if such a vulnerability were present in other components of the system. Regular audits of access logs for anomalies related to key rotation events will help detect any exploitation attempts before they lead to significant security breaches.