Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its ow…

Capgo versions before 12.128.2 contain a broken access control vulnerability in the organization management API. A scoped API key (limited_to_orgs) incorrectly inherits its owner-user's full permissions instead of being restricted to the specified organization. This allows a user who is an admin in multiple organizations to use a write-mode API key restricted to one organization to perform destructive operations against other organizations. Affected endpoints include DELETE /organization and DELETE /organization/members. The root cause lies in route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope. This privilege inheritance flaw can lead to unauthorized deletion of organizations and their members. Users should upgrade to version 12.128.2 or later to remediate the vulnerability.