Authorization Bypass in capgo.app via Channel Permission Overrides

Cap-go capgo.app contains a critical authorization vulnerability (CVE-2026-100617) stemming from improper input validation within the channel_permission_overrides function. The application fails to verify that user principals referenced in permission overrides actually belong to the target organization. This allows an authenticated administrator (at either the application or organization level) to maliciously associate arbitrary external user UUIDs with internal channel permissions. An attacker can leverage this flaw to grant sensitive permissions, such as channel.promote_bundle, to external entities that should have no access to the organization's private channels. This creates a significant risk of unauthorized access to sensitive deployment bundles and internal processes.

Impact

Successful exploitation allows for the unauthorized granting of administrative channel permissions to users outside of the intended organization. This can lead to unauthorized modification of deployment bundles, unauthorized channel management, and potential supply chain compromise if external users gain the ability to influence code or asset promotion within the victim organization's infrastructure.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Audit organizational audit logs for suspicious additions to channel_permission_overrides where the assigned UUID does not correspond to an existing member of the organization.
• Review all current permission overrides within the capgo.app management interface to identify and remove entries involving unrecognized or external UUIDs.
• Update capgo.app to the latest version that implements strict validation of principal organization membership.