Cap-go Channel Permission Override Privilege Escalation

Executive Summary

CVE-2026-100617 is a vulnerability in the Capgo application where authenticated app or organization admins can grant channel permissions to non-member users. The system fails to validate that principals in channel_permission_overrides belong to the organization, allowing admins to insert override rows with arbitrary external user UUIDs. This grants channel-scoped permissions like channel.promote_bundle to unauthorized users outside the organization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review the channel_permission_overrides table in your Capgo database for entries where the target user UUID does not belong to the organization. Check for overrides granting permissions like channel.promote_bundle to external users. Use SQL queries to audit these entries and compare user memberships.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to channel-specific functions, potentially compromising data integrity or enabling malicious actions. Attackers with admin privileges could elevate permissions of non-member users, leading to unauthorized control over channels and associated data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection standards like GDPR and HIPAA. Unauthorized access may result in data breaches, non-compliance with access control policies, and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately revoke any unauthorized channel permissions granted to non-member users. Implement stricter Row-Level Security (RLS) policies to validate that principals in channel_permission_overrides belong to the organization. Consider disabling the channel_permission_overrides feature until a patch is available.

Useful 0 Not Useful 0