EUVD-2026-87722

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

EUVD-2026-87706

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...