CVE-2026-100620: Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAYCONFIGJSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the account-wide impact?
Google Play developer accounts that use the Capgo CLI Android onboarding flow via Google OAuth are exposed if the generated service account key is obtained by an unauthorized party. The permission applies across the entire Play Console developer account, not only to the app selected during onboarding.
What does an attacker need to exploit this issue?
An attacker needs the generated Google Play service account key, identified as PLAY_CONFIG_JSON. With that key, they can create, edit, and delete draft apps across the developer account.
Are the permissions limited to release operations for the selected app?
No. Although the onboarding flow presents the invitation as applying to one confirmed app with release-only permissions, it grants the account-wide CAN_MANAGE_DRAFT_APPS_GLOBAL permission.
What can be done if no patch is available?
No patched version was available at the time of publication. Treat the generated PLAY_CONFIG_JSON service account key as highly sensitive and prevent unauthorized access to it, since possession of the key enables the account-wide draft-app actions described.