High
Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
Type: advisorySource: Official CVE List
Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. A…
Products: capgo.appCVEs: CVE-2026-100615