CVE-2026-100617: Cap-go capgo.app Authorization Bypass via channel_permission_overrides
Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promotebundle to users outside the organization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with app or organization administrator privileges can exploit it. They can create channel permission override entries for arbitrary external user UUIDs.
What access can be granted to users outside the organization?
The attacker can grant channel-scoped permissions to users who are not organization members, including permissions such as channel.promote_bundle. The resulting impact depends on which channel permissions the administrator assigns.
How can defenders identify possible exploitation?
Review channel_permission_overrides entries for principals whose user UUIDs do not correspond to members of the associated organization. Investigate any overrides granting channel permissions to external users, particularly elevated permissions such as channel.promote_bundle.