Capgo Organization Management API Broken Access Control Vulnerability Allowing Cross-Organization Destructive Actions

A broken access control vulnerability has been identified in the Capgo organization management API, prior to version 12.128.2. This vulnerability allows a scoped API key, limited to specific organizations, to inherit the permissions of its owner-user. As a result, it can perform destructive actions across organizations. For instance, if a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still execute harmful operations, such as deleting organization data or members, in another organization. The issue arises from a flaw in route-level authorization, which fails to properly enforce the API key's organizational limitations before applying the owner's user privileges, enabling unauthorized cross-organization actions.

Impact

Exploitation of this vulnerability leads to unauthorized destructive actions in another organization, including the deletion of organization-specific images and the removal of role bindings for users, causing inconsistencies in the data model.

Reproduction

To reproduce this vulnerability, a user must be an admin in two organizations. First, create a write-mode API key restricted to one organization. Then, use that key to send a request to delete an organization or its members in the other organization, which should be denied if the key was properly scoped.

Remediation

For API-key-authenticated requests, enforce organizational scopes before accepting user-based permission successes. Additionally, add explicit organization-scope checks on destructive organization routes that currently rely solely on general permission checks.