Cap-go capgo.app Bundle Promotion rbac_check_permission_direct channel_id improper authorization

Summaryinfo

A vulnerability was found in Cap-go capgo.app. It has been declared as problematic. Affected is the function rbac_check_permission_direct of the component Bundle Promotion. The manipulation of the argument channel_id results in improper authorization. This vulnerability is known as CVE-2026-100627. It is possible to launch the attack remotely. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Cap-go capgo.app (version now known). It has been classified as problematic. Affected is the function rbac_check_permission_direct of the component Bundle Promotion. The manipulation of the argument channel_id with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. CVE summarizes:

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) and omits the request's channel_id. Because the omitted scope field is passed to rbac_check_permission_direct as SQL NULL, and channel-scope override evaluation is gated on p_channel_id IS NOT NULL, per-channel allow/deny overrides are never evaluated. A principal holding app-level channel.promote_bundle (granted by default to the app_developer and app_uploader roles) can therefore promote a bundle to a channel for which an explicit per-channel deny override exists, updating public.channels.version for the supplied channel_id; the target channel is only validated after authorization. The issue is confirmed on main at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely earlier versions; no patched version is known at the time of publication.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-100627 since 09/26/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Applying the patch de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Cap-go

Name

• capgo.app

Website

• Product: https://github.com/Cap-go/capgo.app/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion