CVE-2026-100611
Received Received - Intake

Privilege Escalation in Capgo Backend via API Key Role Assignment

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated user holding only apikey_manager (permissions org.manage_apikeys and org.read) calls POST /apikey with a JWT session, the only checks applied are the org.manage_apikeys permission, a fixed deny-list of assignable role names (APIKEY_MANAGER_DENIED_ASSIGNABLE_ROLES in public/apikey/scope.ts), and a priority-rank comparison in createRoleBindingForPrincipal (private/role_bindings.ts). No check verifies that the caller actually holds the permissions conferred by the role being assigned. Because the deny-list omits the deploy roles app_developer, app_uploader, channel_developer and channel_uploader, and apikey_manager is seeded with priority_rank 78 — higher than those roles' ranks (68, 66, 58, 57) — the rank check also passes. As a result, an apikey_manager who cannot upload bundles or promote channels can mint an API key bound to a deploy role and use it to push arbitrary OTA JavaScript updates to all end users of the organization's apps. As of the advisory publication no patched version was available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100611
EUVD
EUVD-2026-87706

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo.app to 12.261.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100611 is a privilege escalation flaw in Capgo (versions ≤ 12.261.0) where the apikey_manager role can assign API keys with elevated privileges it does not possess. The system fails to verify if the caller holds permissions for the role being assigned. The deny-list omits deploy roles like app_developer and channel_developer, and the apikey_manager's higher priority rank allows bypassing restrictions, enabling unauthorized OTA JavaScript updates to all users.

Impact Analysis

An attacker with apikey_manager access could create an API key with deploy roles and push malicious OTA updates to all users of the organization's apps. This could lead to unauthorized code execution, data breaches, or service disruption within the affected organization.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to user data or system functions. GDPR may be impacted if personal data is exposed, while HIPAA could be affected if protected health information is compromised due to unauthorized updates or access.

Mitigation Strategies

Immediately revoke all API keys issued by users with the apikey_manager role and audit their recent activity. Disable the apikey_manager role's ability to assign API keys with deploy roles until a patch is available. Monitor for unauthorized OTA JavaScript updates pushed to apps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart