Capgo before version 12.128.2 contains an authorization bypass flaw in its webhook management APIs. The function responsible for checking permissions, checkWebhookPermission, skips a call to apikeyHasOrgRightWithPolicy, so requests made with legacy, non‑expiring API keys are not subjected to the organization policy that requires key expiration. As a result, an attacker who possesses such a legacy key can list, create, or delete webhooks regardless of the policy, effectively gaining elevated control over webhook configuration within the application.

The affected product is Capgo, and the vulnerability exists in all releases prior to 12.128.2. No other versions or products are listed as impacted.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must obtain or already hold a legacy, non‑expiring API key; once they have such a key, they can remotely bypass the organization’s webhook policy, allowing unauthorized creation or deletion of webhooks. The risk is contingent on the presence of legacy keys and the sensitivity of the data or actions that can be performed via webhooks.