Grafana - Exposes DingDing API Keys

An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1. id: CVE-2025-3415 info: name: Grafana - Exposes DingDing API Keys author: lucasribolli severity: medium description: | An inciden...

CVE-2026-100628

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100611

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

EUVD-2026-87722

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100628

Versions of capgo.app prior to 12.128.12 are vulnerable to a security flaw where the system fails to enforce organization API key expiration policies for app-scoped keys. Specifically, the POST /apikey endpoint does not include the owner organization in the validation list when app_id is provided...

CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

EUVD-2026-87706

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611

The Capgo (capgo.app backend) version ≤ 12.261.0 is vulnerable to a privilege escalation flaw because the apikey_manager role improperly restricts role binding for new API keys. When an authenticated user with apikey_manager permissions calls POST /apikey , the system fails to verify if the calle...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

PT-2026-99299

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.128.12 Description An authenticated organization member can create a non-expiring app-scoped API key, bypassing the organization's API key expiration policy. This occurs when the owning organization has require...

CVE-2026-100611: Improper Privilege Management

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

PT-2026-99286

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.267.1 Description Insufficient validation of API key privileges during the rotation process allows a user with the apikey manager role to rotate a sibling key belonging to a higher-privileged org super admin. By...

PT-2026-99282

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.261.1 Description The backend improperly restricts the roles that the apikey manager organization role can assign to new API keys. When an authenticated user with apikey manager permissions specifically org.manage...

CVE-2026-100628: Incorrect Authorization

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

PT-2026-94297

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.8.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An inefficient algorithmic complexity issue allows an unauthenticated attacker to cause CPU and memory exhaustion by...

CVE-2026-82279

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...