Capgo before version 12.128.2 allows an attacker with only an app‑scoped API key to call the POST /webhooks/test endpoint. The endpoint mistakenly treats the request as if it came from an organization‑scoped key, enabling the attacker to trigger signed outbound webhook deliveries for any organization webhook outside their authorized app boundary, providing privilege escalation at the organization level. This flaw is classified as CWE‑863.

All deployments of Capgo released prior to version 12.128.2 are affected. This includes every minor release from the Capgo:Capgo vendor that predates 12.128.2. Any instance of Capgo that has not yet been updated to 12.128.2 or newer is vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attackers must first obtain a valid app‑scoped API key and then send a remote HTTP POST request to the /webhooks/test endpoint. Once authenticated, they can invoke organization‑scoped webhook operations that should be reserved for higher‑privilege keys, effectively bypassing the intended scope isolation.