BaseFortify

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves an authorization bypass in the channel creation endpoint.

Authenticated users who have the app.create_channel permission can exploit a logic mismatch between the validation that checks if a channel exists and the operation that creates or updates channels.

By reusing existing channel names, attackers can overwrite existing channels, reassign channel ownership, and modify important production channel configurations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized modification of critical production channels.

Attackers with certain permissions can overwrite existing channels, potentially disrupting communication or operations.

It can result in loss of integrity and availability of channel configurations, which may impact business processes relying on these channels.

Useful 0 Not Useful 0