CVE-2026-100627
Received Received - Intake

Incorrect Authorization in Capgo Supabase Backend Allows Bundle Promotion

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) and omits the request's channel_id. Because the omitted scope field is passed to rbac_check_permission_direct as SQL NULL, and channel-scope override evaluation is gated on p_channel_id IS NOT NULL, per-channel allow/deny overrides are never evaluated. A principal holding app-level channel.promote_bundle (granted by default to the app_developer and app_uploader roles) can therefore promote a bundle to a channel for which an explicit per-channel deny override exists, updating public.channels.version for the supplied channel_id; the target channel is only validated after authorization. The issue is confirmed on main at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely earlier versions; no patched version is known at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100627
EUVD
EUVD-2026-87721

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo From de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100627 is a high-severity authorization flaw in Capgo's server backend (Supabase functions). The PUT /bundle endpoint, accessible to certain API keys, allows bundle promotion without proper channel-specific permission checks. The system omits the target channel ID during authorization, bypassing per-channel deny overrides. This enables users with app-level permissions to promote bundles to restricted channels.

Detection Guidance

To detect this vulnerability, inspect the PUT /bundle endpoint in your Capgo server backend for incorrect authorization checks. Verify if the channel_id is omitted during permission checks in setChannel. Check if per-channel RBAC deny overrides are bypassed due to SQL NULL handling in rbac_check_permission_direct.

Impact Analysis

An attacker could exploit this to push unauthorized bundles to protected channels, compromising system integrity. This may lead to deploying malicious web assets to production channels, potentially disrupting services or exposing sensitive data. The attack requires low privileges and no user interaction.

Mitigation Strategies

Apply patches from PRs #2067 and #2093 which introduce transaction-scoped permission checks including the channel ID. Ensure all API keys and roles have only necessary permissions and review channel-specific RBAC deny overrides for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart