Is CVE-2026-100611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100611 being exploited in the wild.

How severe is CVE-2026-100611?

Medium severity, with a CVSS score of 6.5, published 26 September 2026.

Which products and versions are affected?

Capgo.App Backend ≤ 12.261.0.

Is there a fix for CVE-2026-100611?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100611 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-100611?

Check whether you run Capgo.App Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100611: Capgo apikey_manager role privilege escalation via incomplete role deny-list

CVE-2026-100611 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Capgo is a mobile app deployment platform that provides over-the-air (OTA) updates to end users. An authenticated user with limited API key management permissions can create API keys with elevated deployment capabilities they do not personally hold, allowing them to push arbitrary JavaScript updates to all users of an organization's apps without having direct upload or promotion rights.

Vendors: Capgo.

Quick answers

Is CVE-2026-100611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100611 being exploited in the wild.
How severe is CVE-2026-100611?: Medium severity, with a CVSS score of 6.5, published 26 September 2026.
Which products and versions are affected?: Capgo.App Backend ≤ 12.261.0.
Is there a fix for CVE-2026-100611?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100611 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-100611?: Check whether you run Capgo.App Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The apikey_manager role lacks a check verifying that the caller holds the permissions being assigned to a new API key. Only three guards exist: an org.manage_apikeys permission check, an incomplete deny-list of restricted role names, and a priority-rank comparison. The deny-list omits four deploy roles (app_developer, app_uploader, channel_developer, channel_uploader) and apikey_manager's priority rank (78) exceeds their ranks, allowing the rank check to pass. An authenticated apikey_manager can exploit this to mint API keys with OTA deploy capabilities and push arbitrary updates to all end users.

Affected products

Capgo capgo.app backend ≤ 12.261.0

Timeline

2026-09-26: disclosed
2026-09-26: advisory: GHSA-2x4j-p4pr-fvp8 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.