HIGH 8.7 NVD
CVE-2026-100617
Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant ch
Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.
References
- https://github.com/Cap-go/capgo.app/security/advisories/GHSA-626c-p6fq-3whq
- https://www.vulncheck.com/advisories/cap-go-capgo-app-authorization-bypass-via-channel-per
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.