# CVE-2026-88860: Capgo authorization bypass via stale channel permission overrides

Source: https://junglewise.ai/threats/cve-2026-88860-capgo-authorization-bypass-via-stale-channel-permission-overrides  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88860 · Severity: medium · CVSS 6.3 · Published 2026-09-10

Capgo, a mobile app release management and OTA (over-the-air) update platform, fails to properly clean up channel-specific permission overrides when a user's organization role is revoked. This leaves former employees or restricted users with lingering access to perform sensitive operations—such as pushing unauthorized production app versions—even after their base access should have been removed. An attacker who previously had channel permissions can retain those privileges indefinitely to modify critical app deployments.

Technologies: [Capgo.App](https://junglewise.ai/threats/technologies/capgo-app). Vendors: [Capgo](https://junglewise.ai/threats/vendors/capgo).

## Quick answers

**Is CVE-2026-88860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88860 being exploited in the wild.

**How severe is CVE-2026-88860?** Medium severity, with a CVSS score of 6.3, published 10 September 2026.

**Which products and versions are affected?** Capgo.App all.

**Is there a fix for CVE-2026-88860?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88860 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-88860?** Check whether you run Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization lifecycle bug in Capgo's role-based access control (RBAC) system. When a user's last organization-level role binding is deleted, the application clears their base RBAC role but fails to clean up associated channel_permission_overrides stored in the database. The cleanup logic in role_bindings.ts handles app-scoped and channel-scoped bindings but lacks a handler for organization-scoped bindings. During permission checks, rbac_check_permission_direct() evaluates stale channel overrides without verifying the user still holds an active organization role binding, allowing the overrides to remain authoritative. An authenticated attacker with a valid JWT can exploit this by issuing API requests (e.g., PATCH /rest/v1/channels) to perform unauthorized channel operations like changing production OTA versions. No special privileges or additional user interaction is required beyond possessing a previously-issued JWT token. The issue is present in the main branch, and patches are not yet available.

## Affected products

- Capgo capgo.app all

## Timeline

- 2026-08-27: disclosed: GitHub Security Advisory GHSA-qfxq-2ch8-hjg9 published
- 2026-09-10: advisory: CVE-2026-88860 published on NVD

## References

- [https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qfxq-2ch8-hjg9](https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qfxq-2ch8-hjg9)
- [https://www.vulncheck.com/advisories/capgo-authorization-bypass-via-stale-channel-permission-overrides](https://www.vulncheck.com/advisories/capgo-authorization-bypass-via-stale-channel-permission-overrides)

## Related threats

- [Capgo build upload proxy authorization bypass via TUS resource](https://junglewise.ai/threats/cve-2026-100625-capgo-capgo-app-exposes-a-native-build-tus-upload-proxy-supabase)
- [Capgo.app build upload proxy session expiry bypass](https://junglewise.ai/threats/cve-2026-100624-capgo-app-before-12-264-5-does-not-enforce-upload-expiry-or)
- [Capgo manifest poisoning via app_versions bypass](https://junglewise.ai/threats/cve-2026-100619-capgo-capgo-app-blocks-direct-user-inserts-into-the-public)
- [Capgo app icon update authorization bypass in worker](https://junglewise.ai/threats/cve-2026-100618-capgo-capgo-app-is-affected-by-an-authorization-flaw-in-the-app)
- [Capgo authentication bypass via PostgREST direct write to SSO providers](https://junglewise.ai/threats/cve-2026-88864-capgo-authentication-bypass-via-postgrest-direct-write-to-sso)