CVE-2026-56232 - Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header

Back Back to CVE browser

HIGH

Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header

Published Jun 24, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.47%

Description

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

Affected products

Vendor Capgo Product Capgo Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <12.128.2
- Version
  12.128.2
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Capgo

unaffected

Version	Status	Constraints
0	affected	<12.128.2
12.128.2	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://github.com/Cap-go/capgo/security/advisories/GHSA-2h89-vcvx-5pvh
exploitvendor-advisory
https://www.vulncheck.com/advisories/capgo-subkey-scope-bypass-in-middlewarekey-via-x-limited-key-id-header
third-party-advisory

Link	Providers	Tags
https://github.com/Cap-go/capgo/security/advisories/GHSA-2h89-vcvx-5pvh		exploitvendor-advisory
https://www.vulncheck.com/advisories/capgo-subkey-scope-bypass-in-middlewarekey-via-x-limited-key-id-header		third-party-advisory