Authorization Flaw in Capgo Server Backend API
CVE-2026-100627

7.2HIGH

Key Information:

Vendor

Cap-go

Status
Capgo.app
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100627?

The Capgo server backend contains an authorization flaw in its API-key bundle promotion path. Specifically, the PUT /bundle endpoint allows access to both 'all' and 'write' API keys, enabling improper promotions of bundles due to the missing channel_id in the authorization check. This omission allows principals with app-level permissions to bypass explicit per-channel deny overrides, potentially leading to unauthorized updates in the public channel version. This vulnerability was confirmed in the main repository and likely affects earlier versions, with no patched version available as of the publication date.

Affected Version(s)

capgo.app 0

References

https://github.com/Cap-go/capgo.app/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/capgo-bundle-promoti...
third-party-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.