CVE-2026-100620
Received Received - Intake

Capgo CLI Over-Permissioned Google Play Service Account

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100620
EUVD
EUVD-2026-87715

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo cli to 7.98.2 (exc)
capgo cli to 7.98.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100620 affects Capgo CLI through version 7.98.2 during Android onboarding via Google OAuth. The vulnerability occurs because the CLI grants the generated Google Play service account an account-wide permission (CAN_MANAGE_DRAFT_APPS_GLOBAL) instead of limiting it to a single app as stated in the user interface. This allows the service account to create, edit, and delete draft apps across the entire Google Play developer account.

Detection Guidance

Check for unauthorized Google Play service accounts in your Google Play Console. Look for service accounts with CAN_MANAGE_DRAFT_APPS_GLOBAL permissions. Inspect PLAY_CONFIG_JSON files for unexpected access keys.

Impact Analysis

If an attacker obtains the generated service account key (PLAY_CONFIG_JSON), they could exploit this vulnerability to gain excessive control over your Google Play developer account. This includes creating, modifying, or deleting draft apps across all your apps, not just the one intended during onboarding.

Mitigation Strategies

Remove the CAN_MANAGE_DRAFT_APPS_GLOBAL permission from affected service accounts. Revoke access for any unknown service accounts. Update to the latest version of Capgo CLI if a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart