Grafana - Exposes DingDing API Keys

An incident occurred where the DingDing alerting integration URL was inadvertently exposed to viewers due to a setting oversight in versions below or equals to 12.0.1. id: CVE-2025-3415 info: name: Grafana - Exposes DingDing API Keys author: lucasribolli severity: medium description: | An inciden...

Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via document read operations that return the apiKey field without omitting it, allowing an authenticated user with read access to other us...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via document read operations that return the apiKey field without omitting it, allowing an authenticated user with read access to other user documents to retrieve those users' active API keys in plaintext. The fix...

CVE-2026-100628

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100611

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

EUVD-2026-87722

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100628

Versions of capgo.app prior to 12.128.12 are vulnerable to a security flaw where the system fails to enforce organization API key expiration policies for app-scoped keys. Specifically, the POST /apikey endpoint does not include the owner organization in the validation list when app_id is provided...

CVE-2026-100628 capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611

The Capgo (capgo.app backend) version ≤ 12.261.0 is vulnerable to a privilege escalation flaw because the apikey_manager role improperly restricts role binding for new API keys. When an authenticated user with apikey_manager permissions calls POST /apikey , the system fails to verify if the calle...

EUVD-2026-87706

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100628: Incorrect Authorization

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

PT-2026-99299

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.128.12 Description An authenticated organization member can create a non-expiring app-scoped API key, bypassing the organization's API key expiration policy. This occurs when the owning organization has require...

PT-2026-99282

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.261.1 Description The backend improperly restricts the roles that the apikey manager organization role can assign to new API keys. When an authenticated user with apikey manager permissions specifically org.manage...

CVE-2026-100611: Improper Privilege Management

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

PT-2026-99286

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.267.1 Description Insufficient validation of API key privileges during the rotation process allows a user with the apikey manager role to rotate a sibling key belonging to a higher-privileged org super admin. By...