CVE-2026-100611: Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list
Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager (permissions org.manageapikeys and org.read) calls POST /apikey with a JWT session, the only checks applied are the org.manageapikeys permission, a fixed deny-list of assignable role names (APIKEYMANAGERDENIEDASSIGNABLEROLES in public/apikey/scope.ts), and a priority-rank comparison in createRoleBindingForPrincipal (private/rolebindings.ts). No check verifies that the caller actually holds the permissions conferred by the role being assigned. Because the deny-list omits the deploy roles appdeveloper, appuploader, channeldeveloper and channeluploader, and apikeymanager is seeded with priorityrank 78 — higher than those roles' ranks (68, 66, 58, 57) — the rank check also passes. As a result, an apikeymanager who cannot upload bundles or promote channels can mint an API key bound to a deploy role and use it to push arbitrary OTA JavaScript updates to all end users of the organization's apps. As of the advisory publication no patched version was available.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated organization user whose only relevant role is apikey_manager can exploit it. The user must be able to submit POST /apikey using a JWT session.
What additional access does an attacker gain?
The attacker can create an API key bound to one of the omitted deploy roles: app_developer, app_uploader, channel_developer, or channel_uploader. This can allow them to push arbitrary OTA JavaScript updates to all end users of the organization's apps.
How can I determine whether my deployment is affected?
The affected software is the Capgo capgo.app backend through version 12.261.0. Exposure exists where an apikey_manager can create API keys and assign the omitted deploy roles.
Is a patched version available?
No patched version was available as of the advisory publication date.