Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-88862— Capgo API Key Manager Authentication Bypass via x-limited-key-id

Quick assessment

Affected

Cap-go capgo.app

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Capgo是美国Capgo组织的一个专为CapacitorJS开发者打造的移动应用开发和更新平台。 Capgo 12.242.4及之前版本存在授权问题漏洞，该漏洞源于处理x-limited-key-id标头时未验证父子委托，可能导致已认证的apikey_manager API密钥利用同所有者的更高权限密钥ID，绕过授权并以该密钥权限执行操作，造成权限提升。

CVSS 8.8 · High EPSS 0.44% · P38 Updated Oct 01, 2026

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Cap-go	capgo.app	`≤ 12.242.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88862

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Capgo API Key Manager Authentication Bypass via x-limited-key-id

Source: CVE Program / CVE List V5

Vulnerability Description

Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/functions/_backend/utils/hono_middleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and the authenticating key's user_id, while hasLimitedRbacSubkeyScope() accepts any key with a non-organization (e.g., app-scoped) RBAC binding and validateSubkeyUser() only compares owning user IDs. Because Capgo treats API keys as independent RBAC principals with separate role bindings, an authenticated apikey_manager API key with no application access can supply the numeric ID of a more privileged same-owner key and have the middleware replace the authenticated principal and effective API-key secret with that key (setSubkeyAuthContext), exercising an app_admin sibling's permissions without knowing or submitting its secret. The issue was reproduced on release 12.242.4 (commit b3d02cdbc23ac59990785acacd1f113c07458568) after the fix for GHSA-8h52-44r7-w343; at the time of the advisory no patched version was available.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Vulnerability Title

Capgo 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Cap-go	capgo.app	0 ~ 12.242.4	-

II. Public POCs for CVE-2026-88862

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-88862

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-88862 (2)

https://www.cve.org/CVERecord?id=CVE-2026-88862

Same Patch Batch · Cap-go · 2026-09-10 · 5 CVEs total

CVE-2026-88864	9.1 CRITICAL	Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
CVE-2026-88861	8.3 HIGH	Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
CVE-2026-88863	8.1 HIGH	capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
CVE-2026-88860	6.3 MEDIUM	Capgo Authorization Bypass via Stale Channel Permission Overrides

IV. Related Vulnerabilities

Same product: capgo.app

Same vendor: Cap-go

Same weakness: CWE-863