The capgo.app service allows authenticated members of an organization to create application‑scoped API keys through the POST /apikey endpoint. In versions before 12.128.12 the endpoint does not add the app’s owner organization to the list of organization identifiers passed to the expiration‑policy validator. Because that list is empty, the policy checks return early, permitting the creation of a key that never expires even when the organization requires API‑key expiration. This flaw lets an authenticated user generate a persistent, non‑expiring API key, effectively bypassing the organization’s expiration controls.

This issue affects the Cap‑go Capgo application, specifically all deployments of the web service with a version earlier than 12.128.12. The vulnerability is present in the POST /apikey endpoint used to create app‑scoped API keys and applies to any environment running these affected versions of the service.

The CVSS score of 8.7 signals a high severity impact. The EPSS score is not available, so the exact likelihood of exploitation is uncertain; however, the flaw can be leveraged by any authenticated member of the affected organization. The flaw is classified as CWE‑863 (Improper Validation of Critical Input). Because the attacker only needs legitimate organizational credentials and no elevated administrative rights, the attack vector can be considered internal, yet it enables sustained and privileged access once the malicious key is produced.