Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey
Description
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key can create an unrestricted key with org-wide access to resources like app listings and other protected endpoints.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
Root cause
"Missing authorization check for limited_to_apps in key creation; the server only denies key creation when the caller has limited_to_orgs set, allowing app-limited keys to create unrestricted keys."
Attack vector
**attack_vector_md:** An attacker who possesses an app-limited API key (one with `limited_to_apps` set) can call `POST /functions/v1/apikey` and supply empty `limited_to_apps` and `limited_to_orgs` arrays in the JSON body [ref_id=1]. The server only blocks key creation when the caller's key has `limited_to_orgs` set, so an app-only key passes the existing check [ref_id=1]. The resulting unrestricted key can then be used against org-wide endpoints such as `GET /app` to list all applications, escalating from a single-app scope to full org access [ref_id=1].
What the fix does
**fix_explanation_md:** The advisory's remediation guidance requires that keys with either `limited_to_orgs` or `limited_to_apps` be treated as 'limited' for key-creation purposes, meaning the denial check must fire when either field is populated [ref_id=1]. Additionally, new key limits must be validated as a subset of the caller's limits, preventing the creation of keys with broader (including empty) scopes [ref_id=1]. The patch in version 12.128.2 implements these checks so that an app-limited key can no longer mint an unrestricted key.
Preconditions
- authAttacker must have compromised or be in possession of an API key that has limited_to_apps set (an app-limited key).
- networkThe vulnerable endpoint POST /functions/v1/apikey must be reachable (network access to the Supabase instance).
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-2ff8-7h96-hwfpmitrevendor-advisory
- www.vulncheck.com/advisories/capgo-scope-escalation-via-api-key-creation-in-functions-v1-apikeymitrethird-party-advisory
News mentions
0No linked articles in our index yet.