CVE-2026-100620 in cli
Summary
by MITRE • 09/26/2026
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Capgo CLI versions through 7.98.2 represents a critical misconfiguration within the Android onboarding workflow, specifically concerning the permissions assigned to service accounts generated during Google OAuth integration. This flaw stems from an over-permissioned service account that is provisioned with excessive privileges relative to its intended operational scope. The technical root cause lies in the invocation of the Android Publisher API User create request, where the parameter developerAccountPermissions is explicitly set to CAN_MANAGE_DRAFT_APPS_GLOBAL. This permission grants the associated service account broad administrative capabilities across the entire Google Play Developer Console rather than restricting access to a specific application package as advertised by the user interface and documentation.
From an operational perspective, this discrepancy creates a severe security risk for developers utilizing the CLI tool. The vulnerability exploits the trust placed in automated onboarding flows where users expect granular control over their resources based on explicit consent mechanisms. When a developer initiates the OAuth flow to connect their Google Play account with Capgo CLI, they are led to believe that the resulting service account will be limited to managing releases for a single confirmed application. However, because the backend logic assigns global draft management permissions, any entity that acquires the generated service account key, typically stored in the PLAY_CONFIG_JSON environment variable or configuration file, gains unrestricted ability to create, edit, and delete draft apps across all applications associated with that Google Play developer account. This effectively bypasses standard access control boundaries intended by the platform provider.
The impact of this vulnerability extends beyond simple unauthorized modification of app drafts. An attacker possessing the service account key could inject malicious code into application builds before they are published, alter metadata to facilitate phishing or brand impersonation campaigns, or delete critical draft applications causing significant operational disruption and potential loss of intellectual property. This scenario aligns with CWE-250, which describes vulnerabilities where a process operates with unnecessary privileges, thereby increasing the attack surface if those privileges are compromised. Furthermore, this behavior facilitates privilege escalation within the context of cloud-based application management platforms, allowing lateral movement across different applications owned by the same developer account without requiring additional authentication steps beyond possession of the leaked key.
In terms of threat modeling and adversary tactics, this vulnerability supports techniques associated with ATT&CK ID T1078, specifically Valid Accounts, as it involves the misuse of legitimate credentials to gain unauthorized access. It also relates to T1534, Internal Spearphishing, if an attacker were to use the compromised account to send deceptive communications from within the developer ecosystem, or more directly to data manipulation and sabotage activities enabled by the excessive permissions granted during initial setup. The lack of a patched version at the time of publication exacerbates the risk, leaving users exposed until they manually intervene in their Google Play Console settings.
To mitigate this vulnerability, developers must immediately audit the service accounts associated with Capgo CLI integrations within their Google Play Developer Console. It is essential to verify that no service account possesses global draft management permissions and instead restricts access to specific applications using granular role-based access controls provided by Google. Users should rotate all existing PLAY_CONFIG_JSON keys and regenerate them, ensuring that any new configurations adhere strictly to the principle of least privilege. Until a patched version of Capgo CLI is released that corrects the API call parameters, manual enforcement of restrictive permissions via the Google Play Console interface remains the primary defense against exploitation. Organizations relying on this tool should consider temporary alternatives or enhanced monitoring for unusual activity within their developer accounts, such as unexpected draft creations or deletions, to detect potential compromise early.