CVE-2026-88860
Deferred Deferred - Pending Action

Capgo Channel Permission Override Stale Access Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88860
EUVD
EUVD-2026-75410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo 12.258.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88860 is an authorization bypass vulnerability in Capgo where deleting a user's last organization role binding fails to remove their existing channel permission overrides. This leaves stale overrides active, allowing unauthorized actions like changing production OTA versions even after base RBAC access is revoked.

Detection Guidance

To detect this vulnerability, review active channel permission overrides in Capgo. Check for users with stale overrides by querying the rbac_check_permission_direct function or examining channel settings. Look for users who retain permissions despite having no active organization role bindings.

Impact Analysis

Attackers can retain unauthorized channel-specific permissions to perform actions such as modifying production OTA versions. This means even after revoking a user's organization role, they may still have access to sensitive functions, leading to potential data breaches or system tampering.

Compliance Impact

This vulnerability could lead to unauthorized access and modifications, violating principles of least privilege and access control required by GDPR and HIPAA. Non-compliance may result in legal penalties, data exposure, and loss of trust due to insufficient authorization safeguards.

Mitigation Strategies

Immediately update Capgo to version capgo-12.258.0 or later. Review and remove any stale channel permission overrides for users who no longer have active organization roles. Verify that the rbac_check_permission_direct function now validates active organization relationships before honoring overrides.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88860. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart