Over-permissioned Service Account in Capgo CLI Product by Capgo
CVE-2026-100620

5.1MEDIUM

Key Information:

Vendor

Cap-go

Status
@capgo/cli
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100620?

Capgo CLI versions up to 7.98.2 are susceptible to a security issue involving an over-permissioned service account during the Android onboarding process. When using Google OAuth for onboarding, the system enables the service account with account-wide permissions such as CAN_MANAGE_DRAFT_APPS_GLOBAL. This allows users who acquire the generated service account key (PLAY_CONFIG_JSON) unrestricted abilities to manage draft applications across the entire Google Play developer account, rather than being confined to a specific app with limited permissions. This poses a significant risk as it can lead to unauthorized alterations and management of apps. As of the latest information available, no patched version has been released to address this vulnerability.

Affected Version(s)

@capgo/cli 0 <= 7.98.2

References

https://github.com/Cap-go/capgo.app/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/capgo-cli-through-7....
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.