Capgo versions earlier than 12.128.2 allow an attacker to use any API key created in mode=all but restricted to a single app via limited_to_apps to enumerate, modify, or delete other sibling API keys belonging to the same account. This bypass of the intended app scope grants the attacker the ability to tamper with account‑level credentials, effectively elevating privileges and compromising the confidentiality and integrity of the account.

Capgo software running any release prior to 12.128.2 is vulnerable; the issue is in the public API key management handlers for get/put/delete/post operations where the limited_to_apps restriction is ignored.

The vulnerability carries a CVSS score of 8.7, indicating high severity. No EPSS score is available and it is not listed in CISA KEV, but the flaw can be exercised by any user who possesses an app‑scoped API key, a relatively easy prerequisite. An attacker can enumerate, change, or delete sibling keys without further authentication, providing a straightforward path to gain broader account access.