Role Privilege Escalation in Capgo App's API Key Management

CVE-2026-100611

What is CVE-2026-100611?

The Capgo App backend allows users with the apikey_manager role to improperly bind newly created API keys to unauthorized roles due to flawed permission checks. An authenticated user with limited privileges can exploit this vulnerability to assign API keys to roles that bypass the intended access controls. This flaw arises from an inadequate deny-list for assignable roles and the absence of a verification mechanism to ensure that the user has the rights for the assigned role. Ultimately, this can lead to unauthorized access and manipulation of the app's functionality, enabling malicious users to execute arbitrary JavaScript updates on end-user devices.

References