Executive brief
Cap-go's capgo.app is a mobile app deployment platform that manages application versions and user access controls. Authenticated organization administrators can grant channel-scoped permissions to users outside the organization by directly inserting permission override records, bypassing validation checks. An attacker with admin credentials could escalate privileges for external users to perform actions like promoting app bundles without proper authorization.
Technical details
The channel_permission_overrides table lacks validation that principal IDs belong to the target organization. The RLS INSERT policy only checks if the caller can manage app roles, but does not verify that the principal_id is an organization member, group belongs to the org, or API key is valid. The permission engine subsequently trusts override rows as authoritative, allowing authenticated admins to craft arbitrary overrides with external user UUIDs to grant channel-scoped permissions like channel.promote_bundle.
Affected products
- Cap-go capgo.app all
Timeline
- 2026-09-26: disclosed
- 2026-09-08: advisory: GHSA-626c-p6fq-3whq published