Description (CNA)
Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Capgo / Capgo | affected 0 before 12.128.2; unaffected 12.128.2 |
CWE
CWE-639
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-cppm-733w-hg86
- https://www.vulncheck.com/advisories/capgo-broken-object-level-authorization-via-x-limited-key-id-header
ADP enrichment
No English description supplied.
No references supplied.