Beveiligingsadvies

CVE-2026-56230

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-30 22:08:23

Laatst bijgewerkt 2026-07-01 14:28:44

Toegewezen door VulnCheck

CVSS-score 8.8

Status PUBLISHED

Beschrijving

Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.

← Alle CVE's bekijken Bekijk op cve.org ↗