CVE-2026-100615

Executive Summary

CVE-2026-100615 is a privilege-escalation vulnerability in the Cap-go (capgo.app) platform affecting versions before 12.267.1. The flaw resides in the API key rotation logic, which fails to validate whether the target key holds equal or lower privileges than the rotating principal. An authenticated attacker holding an apikey_manager role can enumerate sibling keys owned by the same organization, rotate a higher-privileged org_super_admin key, and recover the newly generated plaintext secret, effectively impersonating the superior principal. With a CVSS 3.1 score of 8.8 (High), the vulnerability enables full confidentiality and integrity compromise across the affected organization's resources.

Technical Analysis

The vulnerability is classified as CWE-269 (Improper Privilege Management) and stems from an authorization logic deficiency in the API key rotation feature. Cap-go's platform permits API keys to be rotated via a PUT endpoint. When a rotation request is submitted, the backend is expected to verify that the requesting principal possesses privileges at least equal to the key being rotated. The NVD description states that capgo.app "fails to validate target API key privilege during rotation," meaning the authorization check either is absent or does not compare the privilege levels of the acting key and the target key.

Because of this missing comparison, an attacker authenticated with the apikey_manager role can supply a target key identifier belonging to a sibling key owned by the same account/owner. The rotation operation proceeds even when the target key is an org_super_admin key—a role with substantially broader permissions than apikey_manager. Critically, the rotation process returns the replacement plaintext secret to the caller, so the attacker immediately obtains a working credential for the higher-privileged principal rather than merely invalidating it.

The attack surface is the authenticated API management interface. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that exploitation is network-reachable with low complexity, requires only low privileges (the apikey_manager role), needs no user interaction, and yields high confidentiality and integrity impact without affecting scope beyond the vulnerable component. No patch, workaround, or affected version list beyond "before 12.267.1" is provided in the available data.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / Target Identification: The attacker first obtains legitimate access to a Cap-go account with the apikey_manager role. Using that access, they enumerate API keys associated with the same owner/organization to identify a sibling key that carries the org_super_admin role. The description explicitly notes that attackers can "enumerate same-owner API keys."

2. Triggering the Flaw: The attacker issues a rotation request against the identified higher-privileged org_super_admin key. The request targets the key via the PUT endpoint used for rotation. Because the platform does not validate whether the target key's privilege level is appropriate relative to the requester, the rotation is accepted despite the attacker holding only apikey_manager.

3. Payload / Execution (vulnerability-class level): This is an improper privilege management / broken access control issue rather than an injection or memory-safety flaw. The "payload" is the rotation request itself—no code execution or malformed input is required. The privilege check that should have rejected the request is simply missing, so the request succeeds on the strength of a valid-but-underprivileged session.

4. Post-Exploitation Impact: The rotation operation returns the replacement plaintext secret for the org_super_admin key to the attacker. Armed with this credential, the attacker authenticates as the higher-privileged principal, "obtain[ing] the replacement plaintext secret to authenticate as the higher-privileged principal." This grants the full privileges of org_super_admin, enabling lateral movement, data access, and configuration changes at the organization level.

Impact Assessment

Successful exploitation results in full compromise of the higher-privileged principal's identity. The CVSS vector assigns High impact to Confidentiality (C:H), Integrity (I:H), and Availability (A:H), consistent with an attacker gaining super-admin control over an organization's Cap-go tenant. Because the attacker obtains a valid plaintext secret, the compromise is persistent and blends into legitimate API traffic, complicating detection.

Blast radius includes all resources, keys, and configurations governed by the compromised org_super_admin account, which by design exceeds the reach of a single apikey_manager. The Scope metric is Unchanged (S:U), indicating the exploited component's authority boundary is the affected security authority, though the practical effect is organization-wide. The business impact includes unauthorized access to application distribution infrastructure, potential supply-chain exposure if the platform manages app bundles, and loss of trust in key-management guarantees. There is no evidence of exploitation in the wild, and no CISA KEV listing.

Detection Guidance

Detection focuses on anomalous API key rotation events and privilege-tier mismatches between the rotating principal and the target key. Because the operation is a legitimate API call, detections must key on behavior and context rather than signatures.

Sigma Rule

title: Cap-go API Key Rotation of Higher-Privileged Sibling Key
id: 7f3c1a2e-9b64-4d21-8e77-capgo100615
status: experimental
description: Detects rotation of an org_super_admin API key by a lower-privileged apikey_manager principal (CVE-2026-100615).
logsource:
  product: capgo
  service: api
detection:
  selection_method:
    http.method: 'PUT'
    url.path|contains: '/api_key'
  selection_rotation:
    event.action|contains: 'rotate'
  selection_privilege:
    actor.role: 'apikey_manager'
    target_key.role: 'org_super_admin'
  condition: selection_method and selection_rotation and selection_privilege
falsepositives:
  - Legitimate administrative rotation performed by an org_super_admin
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026-100615

YARA Rule

rule CVE_2026_100615_Capgo_KeyRotation_Abuse
{
    meta:
        description = "Detects references to Cap-go API key rotation privilege escalation (CVE-2026-100615)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100615"
    strings:
        $role1 = "apikey_manager" ascii nocase
        $role2 = "org_super_admin" ascii nocase
        $act1  = "rotate" ascii nocase
        $ep1   = "/api_key" ascii nocase
    condition:
        uint16(0) == 0x5A4D or (any of them and 2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100615 Cap-go API Key Rotation Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/api_key"; http.uri; content:"rotate"; nocase; reference:cve,2026-100615; classtype:attempted-admin; sid:2026100615; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "PUT" and url.path contains "/api_key" and url.path contains "rotate"]
  [any where capgo.actor.role == "apikey_manager" and capgo.target_key.role == "org_super_admin"]

Splunk SPL Query

index=capgo sourcetype=capgo:api http_method=PUT url_path="*/api_key*"
| where match(url_path, "(?i)rotate")
| eval actor_role=lower(actor_role), target_role=lower(target_key_role)
| where actor_role="apikey_manager" AND target_role="org_super_admin"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by user, actor_role, target_role
| sort - count

Wazuh OSSEC Rule

<group name="capgo,cve-2026-100615,">
  <rule id="100615" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">PUT</field>
    <field name="url.path">/api_key</field>
    <field name="event.action">rotate</field>
    <field name="actor.role">apikey_manager</field>
    <field name="target_key.role">org_super_admin</field>
    <description>CVE-2026-100615: apikey_manager rotated a higher-privileged org_super_admin API key</description>
    <mitre>
      <id>T1078</id>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Audit all API keys within each tenant and identify any rotation events where the acting principal's role was lower than the target key's role.
   • Immediately rotate all org_super_admin keys that may have been exposed, and invalidate any keys of unknown provenance.
   • Restrict the apikey_manager role so it cannot enumerate or act upon keys outside its own privilege tier—enforce this at the API gateway or WAF by inspecting rotation requests if the application cannot be modified.
   • Enforce least privilege: limit the number of principals granted apikey_manager, and monitor their API activity closely.

2. Patch / Upgrade Steps:

   • Upgrade capgo.app to version 12.267.1 or later, which per the NVD description is the version boundary that addresses the missing target privilege validation.
   • Verify the target version is genuinely deployed and confirm that rotation now rejects requests where the target key outranks the requester.
   • Because no vendor advisory or patch source is currently tracked, independently validate the fix behavior after upgrading and monitor upstream releases for any follow-up advisories.

3. Long-Term Hardening:

   • Implement server-side authorization checks that compare the privilege level of the requesting principal against the target key before any rotation occurs.
   • Never return plaintext secrets for keys that outrank the requester; scope secret disclosure to the key owner's privilege tier.
   • Adopt structured logging for all key lifecycle events (create, rotate, revoke) with actor, target, and role context, forwarded to the SIEM.
   • Apply role-based access control reviews and periodic key rotation policies, and consider requiring re-authentication or MFA for rotation of high-privilege keys.

References

• NVD — CVE-2026-100615: https://nvd.nist.gov/vuln/detail/CVE-2026-100615
• MITRE CWE-269 (Improper Privilege Management): https://cwe.mitre.org/data/definitions/269.html
• FIRST EPSS (no score currently available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Cap-go platform (vendor product reference): https://capgo.app

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-100615 at this time. No public proof-of-concept, exploit code, or Nuclei template is available.