Channel Permission Bypass Vulnerability in Cap-go App
CVE-2026-100617

8.7HIGH

Key Information:

Vendor

Cap-go

Status
Capgo.app
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100617?

The Cap-go app lacks proper validation for channel_permission_overrides, which permits authenticated administrators to grant channel permissions to users not belonging to the organization. This flaw allows an attacker with admin rights to manipulate permissions by inserting arbitrary external user UUIDs. As a result, unauthorized individuals can be granted important channel-based permissions, which could lead to severe security breaches.

Affected Version(s)

capgo.app 0

References

https://github.com/Cap-go/capgo.app/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/cap-go-capgo-app-aut...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Judel777
.