CVE-2026-56310

Executive Summary

CVE-2026-56310 is an authorization bypass vulnerability in the Cap-go application (versions before 12.128.2). The flaw resides in the GET /organization/members endpoint, where API keys with org-limited scope fail to properly enforce the limited_to_orgs restriction. This allows an attacker possessing a valid org-limited API key to enumerate membership data—including uid, email, image_url, role, and is_tmp—from organizations outside their intended scope. The vulnerability is classified as a Missing Authorization (CWE-862) and has a CVSS v3.1 base score of 5.3 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. No public proof-of-concept (PoC) or exploit code has been released as of this analysis.

Supply Chain & Package Security

Cap-go is a Go-based application. The vulnerability affects the software supply chain by potentially exposing sensitive user data (email addresses, roles, temporary status) from any organization using the same Cap-go instance. Organizations that rely on Cap-go for identity or access management should treat this as a high-priority supply chain risk, as the leaked data could be used for targeted phishing or social engineering attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is remotely accessible.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid org-limited API key.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Sensitive membership data is exposed.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: Medium. While the CVSS score is 5.3, the actual risk is elevated because the vulnerability allows enumeration of user identities across organizations, which can be a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability exists in the authorization logic of the GET /organization/members endpoint. In Cap-go, API keys can be scoped to specific organizations via the limited_to_orgs field. The intended behavior is that an org-limited key should only return members of the organizations it is scoped to. However, due to a missing or insufficient check, the endpoint does not validate that the requested organization ID matches the key's scope. As a result, an attacker can supply any organization ID (e.g., via a path parameter or query string) and retrieve that organization's member list.

The endpoint returns a JSON array containing objects with fields: uid, email, image_url, role, and is_tmp. This data can be used to map out user identities, identify temporary accounts, and understand role hierarchies within target organizations.

Vulnerable vs. Patched Code

Vulnerable Code (before 12.128.2):

func (h *Handler) GetOrganizationMembers(w http.ResponseWriter, r *http.Request) {
    orgID := r.URL.Query().Get("org_id")
    // Missing: check if the API key's limited_to_orgs includes orgID
    members, err := h.db.GetMembersByOrgID(orgID)
    // ...
}

Patched Code (12.128.2+):

func (h *Handler) GetOrganizationMembers(w http.ResponseWriter, r *http.Request) {
    orgID := r.URL.Query().Get("org_id")
    apiKey := r.Header.Get("X-API-Key")
    keyScopes := h.db.GetKeyScopes(apiKey)
    if !contains(keyScopes.LimitedToOrgs, orgID) {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    members, err := h.db.GetMembersByOrgID(orgID)
    // ...
}

The patch adds a scope validation step that ensures the requested org_id is present in the API key's limited_to_orgs list before returning any data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid org-limited API key from any organization.
• Network access to the Cap-go instance.

Exploitation Steps:

1. Obtain an org-limited API key (e.g., via a compromised account or legitimate access).
2. Enumerate organization IDs (e.g., by brute-forcing numeric IDs or using leaked data).
3. For each organization ID, send a GET request to the vulnerable endpoint:

   curl -H "X-API-Key: YOUR_ORG_LIMITED_KEY" "https://target-cap-go-instance/organization/members?org_id=TARGET_ORG_ID"
   

4. Parse the JSON response to extract user data.

Lab Setup:

• Deploy a vulnerable Cap-go instance (version < 12.128.2) using Docker:

  docker run -d -p 8080:8080 cap-go/cap-go:12.128.0
  

• Create two organizations (OrgA and OrgB) with test users.
• Generate an API key scoped only to OrgA.
• Use the above curl command to attempt to read OrgB's members.

Blue Team

Detection:

• Monitor for API requests to /organization/members with unusual org_id parameters from a single API key.
• Alert on multiple 403 responses followed by a 200 for different org IDs from the same key (indicating scope probing).
• Correlate API key usage with the limited_to_orgs scope in logs.

Hunting:

• Search logs for patterns where an API key accesses more than one unique org_id on the /organization/members endpoint.
• Review historical access logs for any org-limited keys that accessed organizations outside their scope.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /organization/members with varying org_id parameters from the same source IP/API key.
  • Response bodies containing arrays of user objects with fields uid, email, image_url, role, is_tmp.
• Logs:
  • API access logs showing a single API key querying multiple organization IDs on the /organization/members endpoint.
  • Absence of authorization failure logs for such requests (if logging is incomplete).
• File/System:
  • No file-based IOCs; this is a purely API-level vulnerability.

Detection Engineering

YARA Rule

rule CVE_2026_56310_Cap_go_Authorization_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2026-56310 in Cap-go"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-56310"
    strings:
        $endpoint = "/organization/members"
        $org_param = "org_id="
        $user_fields = /"uid":\s*"[^"]*"/ or /"email":\s*"[^"]*"/ or /"role":\s*"[^"]*"/
    condition:
        $endpoint and $org_param and #user_fields > 3
}

Sigma Rule

title: Cap-go Authorization Bypass via /organization/members
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-56310 by querying multiple org_ids with a single API key
author: Valters IT
logsource:
    category: web
    product: generic
detection:
    selection:
        cs-uri-stem: "/organization/members"
        cs-uri-query|contains: "org_id="
    filter:
        cs-uri-query|re: "org_id=[0-9]+"
    condition: selection and not filter
falsepositives:
    - Legitimate multi-org access by admin keys (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56310 Cap-go Authorization Bypass Attempt"; flow:to_server; content:"/organization/members"; http_uri; content:"org_id="; http_uri; pcre:"/org_id=\d+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Cap-go to version 12.128.2 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /organization/members where the org_id parameter does not match the API key's scope (requires custom logic).
3. Rotate all existing API keys to ensure compromised keys are invalidated.

Long-term:

• Conduct a code review of all authorization logic in Cap-go to identify similar bypasses.
• Implement automated testing for authorization checks using tools like OWASP ZAP or Burp Suite.
• Enforce the principle of least privilege for API key scopes.

Valters IT – Securing your digital frontier.