https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:46:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333962 EUVD-2026-333962 https://cve.radiocsirt.org/vuln/euvd-2026-333962 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56246 <p>Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user&#39;s permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner&#39;s user privileges before enforcing the API key&#39;s limited_to_orgs scope.</p> <p>Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user&#39;s permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner&#39;s user privileges before enforcing the API key&#39;s limited_to_orgs scope.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56246 https://cve.radiocsirt.org/vuln/ghsa-46rc-2xqj-534f <p>Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user&#39;s permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner&#39;s user privileges before enforcing the API key&#39;s limited_to_orgs scope.</p> <p>Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user&#39;s permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner&#39;s user privileges before enforcing the API key&#39;s limited_to_orgs scope.</p> https://cve.radiocsirt.org/vuln/ghsa-46rc-2xqj-534f