Is CVE-2026-88860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88860 being exploited in the wild.

How severe is CVE-2026-88860?

Medium severity, with a CVSS score of 6.3, published 10 September 2026.

Is there a fix for CVE-2026-88860?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88860 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-88860?

Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88860: Capgo authorization bypass via stale channel permission overrides

CVE-2026-88860 · Severity: medium · CVSS 6.3 · Published 2026-09-10

Capgo, a mobile app release management and OTA (over-the-air) update platform, fails to properly clean up channel-specific permission overrides when a user's organization role is revoked. This leaves former employees or restricted users with lingering access to perform sensitive operations—such as pushing unauthorized production app versions—even after their base access should have been removed. An attacker who previously had channel permissions can retain those privileges indefinitely to modify critical app deployments.

Technologies: Capgo.App. Vendors: Capgo.

Quick answers

Is CVE-2026-88860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88860 being exploited in the wild.
How severe is CVE-2026-88860?: Medium severity, with a CVSS score of 6.3, published 10 September 2026.
Which products and versions are affected?: Capgo.App all.
Is there a fix for CVE-2026-88860?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88860 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-88860?: Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization lifecycle bug in Capgo's role-based access control (RBAC) system. When a user's last organization-level role binding is deleted, the application clears their base RBAC role but fails to clean up associated channel_permission_overrides stored in the database. The cleanup logic in role_bindings.ts handles app-scoped and channel-scoped bindings but lacks a handler for organization-scoped bindings. During permission checks, rbac_check_permission_direct() evaluates stale channel overrides without verifying the user still holds an active organization role binding, allowing the overrides to remain authoritative. An authenticated attacker with a valid JWT can exploit this by issuing API requests (e.g., PATCH /rest/v1/channels) to perform unauthorized channel operations like changing production OTA versions. No special privileges or additional user interaction is required beyond possessing a previously-issued JWT token. The issue is present in the main branch, and patches are not yet available.

Affected products

Capgo capgo.app all

Timeline

2026-08-27: disclosed: GitHub Security Advisory GHSA-qfxq-2ch8-hjg9 published
2026-09-10: advisory: CVE-2026-88860 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.