Description
Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Capgo | Capgo | < 12.128.2 | 12.128.2 |
References
- GitHub Security Advisory (GHSA-cppm-733w-hg86) vendor-advisory
- VulnCheck Advisory: Capgo - Broken Object Level Authorization via x-limited-key-id Header third-party-advisory