CVE-2026-56310: Improper Authorization in Cap-go capgo
Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limited_to_orgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, image_url, role, and is_tmp from organizations outside their assigned scope.
AI Analysis
Technical Summary
CVE-2026-56310 describes an authorization bypass vulnerability in Cap-go prior to version 12.128.2. The issue exists in the GET /organization/members API endpoint, where org-limited API keys fail to enforce the limited_to_orgs restriction properly. As a result, attackers possessing such API keys can access membership information from organizations they are not authorized to view. The exposed data includes user identifiers, email addresses, image URLs, roles, and temporary membership flags. The vulnerability has been publicly disclosed but no official fix or patch has been documented at this time.
Potential Impact
Attackers with org-limited API keys can bypass intended access controls and retrieve sensitive membership data from unauthorized organizations. This exposure includes personally identifiable information (uid, email), user profile images, roles within the organization, and temporary membership status. While this does not allow privilege escalation or modification of data, it compromises confidentiality of organizational membership information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict issuance and distribution of org-limited API keys to trusted parties only and monitor API key usage for anomalous access patterns related to organization membership data.
CVE-2026-56310: Improper Authorization in Cap-go capgo
Description
Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limited_to_orgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, image_url, role, and is_tmp from organizations outside their assigned scope.
CVSS v4.0
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56310 describes an authorization bypass vulnerability in Cap-go prior to version 12.128.2. The issue exists in the GET /organization/members API endpoint, where org-limited API keys fail to enforce the limited_to_orgs restriction properly. As a result, attackers possessing such API keys can access membership information from organizations they are not authorized to view. The exposed data includes user identifiers, email addresses, image URLs, roles, and temporary membership flags. The vulnerability has been publicly disclosed but no official fix or patch has been documented at this time.
Potential Impact
Attackers with org-limited API keys can bypass intended access controls and retrieve sensitive membership data from unauthorized organizations. This exposure includes personally identifiable information (uid, email), user profile images, roles within the organization, and temporary membership status. While this does not allow privilege escalation or modification of data, it compromises confidentiality of organizational membership information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict issuance and distribution of org-limited API keys to trusted parties only and monitor API key usage for anomalous access patterns related to organization membership data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-20T12:53:19.893Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3bc8faeed863c81ecab8d9
Added to database: 06/24/2026, 12:09:30 UTC
Last enriched: 07/01/2026, 22:45:11 UTC
Last updated: 08/05/2026, 00:41:15 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.