Capgo servers before version 12.128.2 allow an attacker to increase privileges by creating an unrestricted API key through the POST /functions/v1/apikey endpoint. An app-limited key that has a restricted scope can set empty limits during key creation, resulting in a new key with org‑wide access to resources such as app listings and protected endpoints. The vulnerability is a classic privilege escalation flaw (CWE‑269).

Capgo acts as the affected product. All installations running any earlier version than 12.128.2 are vulnerable. If a user is running a Capgo deployment based on version 12.128.2 or later, the issue is mitigated.

The CVSS score of 8.7 indicates a high severity with potential for extensive impact. EPSS data is not provided, but the lack of exploitation records and the absence of a listing in the CISA KEV catalog suggest that active exploitation may be limited so far. Nonetheless, the vulnerability can be exploited by any actor who has obtained an app‑limited key, a state that can be achieved through phishing or credential compromise. The attacker can then request a new key with no limits, effectively hijacking org‑wide administrative capabilities.