Cap-go before version 12.128.2 has a vulnerability in the GET /organization/members endpoint that allows an attacker who possesses an organization-limited API key to bypass the intended scope restrictions. The flaw lets the attacker retrieve detailed membership information—such as user identifiers, email addresses, profile image URLs, roles, and temporary status—of organizations outside the key’s assigned scope, thereby compromising confidential data about users in other organizations. This weakness falls under CWE-285 (Authorization Bypass via Privilege Escalation).

Vulnerable instances of Cap-go running any version earlier than 12.128.2 are affected. The product is identified as Cap-go:capgo in the CNA data. Attackers can exploit the flaw through the web API exposed by Cap-go deployments that provide organization-limited API keys.

The CVSS score of 5.3 classifies the issue as moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation requires an existing organization-limited API key, the primary risk is to organizations that issue such keys without robust controls. Though no EPSS score is available, the presence of a focused API endpoint suggests that an attacker could leverage the flaw if they acquire or guess a valid key. No remote code execution or privilege escalation on the host is reported, but the data leakage could lead to social engineering or account compromise for affected users.