CVE-2026-100615

8.8 HIGHpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI risk analysis

Summary: The flaw allows an apikey_manager to rotate a higher-privileged org_super_admin API key, leading to credential recovery. This matters because it enables privilege escalation and unauthorized access.
Exploitability: Exploitation requires an attacker to have the apikey_manager role and knowledge of the API key management process. The exploit is moderately hard to execute.
Blast radius: If exploited, this could lead to full control over the org_super_admin account, compromising the entire system and sensitive data.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Cap-go capgo.app 12.267.1 or later.

auth-bypassprivilege-escalationapi

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as the higher-privileged principal.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.