CVE-2026-56230Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-07-01); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-30/TIER_2_CVE-2026-56230.md

Full discourse2 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs91d
Disclosure
CVE-2026-56230 Capgo Broken object-level authorisation could let authenticated users misuse API key identifiers to access another tenant’s resources. Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-30/TIER_2_CVE-2026-56230.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
CVE-2026-56230 exposes a broken object‑level authorization flaw that allows authenticated users to misuse API key identifiers and access resources belonging to other tenants. A detailed report is linked, but no PoC, exploit code, active exploitation, patch, or debunking is provided.
0010093
56 followersView on X
Joey Romaine 🇺🇸 |=★=|@Tank23x080d
Disclosure
CVE-2026-56230 just dropped. High severity — worth your attention today. Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts... The best defense is the one you set up before you needed it.
Post summary
The post announces CVE-2026-56230, highlighting a broken object‑level authorization flaw in Capgo’s middlewareKey() with high severity, but it does not mention PoC, exploit code, active exploitation, or any patch.
0000064
339 followersView on X

Explore more

Back to dashboard