Capgo versions prior to 12.128.2 contain a Cross‑Tenant Authorization Bypass in PostgREST endpoints that permits organization‑scoped read API keys to retrieve webhook secrets and delivery logs belonging to other tenants. An attacker possessing such a key can query “webhooks” and “webhook_deliveries” endpoints to exfiltrate HMAC signing secrets and payloads, enabling the creation of forged webhook events that can be sent to victim organizations. This exposure results in the disclosure of confidential secrets (CWE‑200) and the potential for unauthorized operation execution via fabricated webhook messages.

The affected vendor is Capgo, specifically the Capgo application prior to version 12.128.2. The vulnerability applies to all deployments that expose the PostgREST API endpoints "webhooks" and "webhook_deliveries" to organization‑level read keys.

The CVSS score of 7.1 indicates a high‑moderate severity risk, while the EPSS score is unavailable, making the likelihood of exploitation uncertain. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires possession of a valid organization‑scoped read API key; such keys may be compromised or misused. An attacker who can obtain or guess these keys can exfiltrate secrets and forge webhook traffic to compromise other tenants, representing a serious confidentiality threat and potential for denial of service or further lateral movement.