A critical authorization bypass in Capgo allows attackers to escalate privileges by circumventing subkey scope restrictions, resulting in unauthorized access to sensitive application data.

The middlewareKey function fails to correctly enforce scope constraints for subkeys provided via the x-limited-key-id header. By referencing their own subkeys, an attacker can cause the application to revert to the unrestricted parent key, effectively bypassing intended data access limitations.

With a CVSS score of 8.8, this flaw represents a significant risk to data confidentiality and integrity. Successful exploitation allows unauthorized users to access resources and perform actions that should be restricted, potentially leading to unauthorized data exposure or modification across the organization's application ecosystem.

Immediate Action: Upgrade to Capgo version 12.128.2 or later to ensure proper enforcement of subkey scope constraints.

Proactive Monitoring: Review access logs for anomalous API requests that utilize the x-limited-key-id header, specifically looking for patterns where a user's subkey is used to access resources outside of their assigned scope.

Compensating Controls: If immediate patching is not feasible, implement strict API gateway validation to enforce organizational and application-level scoping independent of the application logic.

Public Exploit Available: true

Authorization bypass vulnerabilities are frequently leveraged to escalate privileges within cloud-native environments. Organizations must apply the update to 12.128.2 promptly to ensure that security boundaries are correctly enforced and to prevent unauthorized access to restricted application data.