Capgo versions before 12.128.2 have a scope isolation vulnerability in the POST /webhooks/test endpoint. This flaw allows app-scoped API keys to invoke organization-scoped webhook operations, bypassing the intended authorization checks that limit API keys to their declared app boundaries. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their app scope.