https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:49:18 +0000 https://cve.radiocsirt.org/vuln/cve-2026-56246 <p><strong>Affected:</strong> Capgo</p> <p>Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user&#39;s permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner&#39;s user privileges before enforcing the API key&#39;s limited_to_orgs scope.</p> <p><strong>Affected:</strong> Capgo</p> <p>Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user&#39;s permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner&#39;s user privileges before enforcing the API key&#39;s limited_to_orgs scope.</p> https://cve.radiocsirt.org/vuln/cve-2026-56246