Executive brief
Capgo, a mobile app release management and OTA (over-the-air) update platform, fails to properly clean up channel-specific permission overrides when a user's organization role is revoked. This leaves former employees or restricted users with lingering access to perform sensitive operations—such as pushing unauthorized production app versions—even after their base access should have been removed. An attacker who previously had channel permissions can retain those privileges indefinitely to modify critical app deployments.
Technical details
The vulnerability is an authorization lifecycle bug in Capgo's role-based access control (RBAC) system. When a user's last organization-level role binding is deleted, the application clears their base RBAC role but fails to clean up associated channel_permission_overrides stored in the database. The cleanup logic in role_bindings.ts handles app-scoped and channel-scoped bindings but lacks a handler for organization-scoped bindings. During permission checks, rbac_check_permission_direct() evaluates stale channel overrides without verifying the user still holds an active organization role binding, allowing the overrides to remain authoritative. An authenticated attacker with a valid JWT can exploit this by issuing API requests (e.g., PATCH /rest/v1/channels) to perform unauthorized channel operations like changing production OTA versions. No special privileges or additional user interaction is required beyond possessing a previously-issued JWT token. The issue is present in the main branch, and patches are not yet available.
Affected products
- Capgo capgo.app all
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-qfxq-2ch8-hjg9 published
- 2026-09-10: advisory: CVE-2026-88860 published on NVD