The vulnerability resides in Capgo’s middlewareKey function, where subkeys transmitted via the x-limited-key-id header are not correctly validated against limited_to_orgs and limited_to_apps constraints. This omission allows an attacker to reference a subkey that they control, causing all downstream requests to be processed with the parent key rather than the intended scoped subkey. The result is a loss of confidentiality and integrity for any data protected by the parent key, and can lead to unauthorized data access or manipulation across the application. Cybersecurity weakness identified as CWE‑863, a subroutine authorization issue.

Capgo server application versions prior to 12.128.2 are vulnerable. The issue affects the Capgo product, specifically its middleware handling of API key scoping. Users deploying Capgo 12.128.1 or earlier on any configuration that accepts external HTTP requests are at risk.

The CVSS score of 8.7 indicates high severity, suggesting significant potential impact if exploited. The EPSS score is not available, so the current estimate of exploitation probability is unknown, but the vulnerability’s nature implies a direct, in‑band exploitation possible by sending crafted HTTP headers. The issue is not listed in the CISA KEV catalog, yet its high CVSS implies that organizations should treat it as a critical flaw. Attackers would likely use standard HTTP clients to send the x-limited-key-id header, bypassing you authorization controls without additional privileges.