Capgo before version 12.128.2 contains a broken access control flaw (CWE‑285). A scoped API key that is limited to one organization inherits its owner‑user’s full privileges, allowing it to perform destructive operations such as deleting an organization or removing the organization’s members. The root cause is that the route‑level authorization method evaluates the API key owner's privileges before enforcing the limited_to_orgs scope, so the key’s limited scope is effectively ignored.

Any deployment of Capgo using a version earlier than 12.128.2 is affected. The flaw exists in the organization management API endpoints that process DELETE requests on organizations and organization members. Administrators who own multiple organizations and generate scoped API keys are most at risk.

With a CVSS score of 7.2, the vulnerability is in the moderate‑to‑high range, while an EPSS score of less than 1% indicates a very low but non‑zero exploitation likelihood. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an administrator with privileges in at least two organizations and the ability to create a scoped write‑mode API key restricted to one organization. Because the key inherits the administrator’s full rights, it can carry out destructive actions against other organizations the attacker can reach, producing a significant risk for environments where multi‑organization admin rights exist.