PT-2026-51501

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limited to apps are only checked for limited to orgs and not for limited to apps, so an app-scoped...