An authorization bypass vulnerability in Capgo platforms allows authenticated users to access data across organizations, representing a severe risk to data confidentiality.

The software suffers from improper authorization (CWE-285), specifically concerning how scoped API keys inherit privileges. An authenticated user can exploit this to bypass organizational boundaries and access resources they are not authorized to view or manage.

This vulnerability enables cross-organization data access, which could result in unauthorized disclosure of sensitive project data or intellectual property. With a CVSS score of 8.1, the flaw is critical for multi-tenant environments where strict isolation between organizations is required for compliance and security.

Immediate Action: Upgrade to Capgo version 12.128.2 or later to ensure proper authorization checks are enforced across all API keys.

Proactive Monitoring: Audit API key usage and logs to identify any anomalous cross-organization access attempts that may have occurred prior to patching.

Compensating Controls: Rotate all existing API keys and enforce the principle of least privilege when generating new keys until the system is updated.

Public Exploit Available: false

Organizations using Capgo must prioritize the update to version 12.128.2. Given the potential for cross-tenant data leakage, immediate remediation is necessary to maintain the integrity and privacy of the hosted development environments.