Description

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T14:16:42.467Z",
  "pubdate": "2026-09-26T14:16:42.467Z",
  "executiveSummary": "Cap-go is susceptible to an improper authorization vulnerability within the channel_permission_overrides configuration. The flaw stems from a lack of server-side validation ensuring that principals (users) assigned to permission overrides belong to the target organization.\nThe vulnerability allows an authenticated attacker already possessing organization or application administrator privileges to grant sensitive, channel-scoped permissions to arbitrary external user UUIDs that have no affiliation with the organization.\nThe primary impact involves unauthorized privilege escalation and information disclosure, as external users can be granted permissions such as channel.promote_bundle, potentially allowing them to modify or deploy application bundles in environments they are not authorized to access.\nExploitation requires the attacker to possess existing administrative credentials within the platform. By manipulating the request payload to include an external UUID in the channel_permission_overrides table, an attacker can bypass organizational boundaries. This risk is significant in multi-tenant environments where strict isolation between organizational members and external identities is a foundational security requirement.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate validation mechanism during the processing of channel permission modifications within the Cap-go application. Specifically, the system fails to perform a referential integrity or membership check to verify that a principal UUID provided in the channel_permission_overrides request belongs to the authorized organization context.\nThe vulnerable component resides in the backend logic responsible for updating channel-scoped access control lists (ACLs). When an administrator updates these overrides, the application directly processes the provided principal identifier without cross-referencing the database for membership within the organization scope associated with the targeted channel.\nAttack flow involves the following steps: 1. The attacker authenticates as a legitimate application or organization administrator. 2. The attacker identifies or crafts a malicious request targeting the permission override interface. 3. The attacker injects an arbitrary external user UUID into the 'principals' field of the channel_permission_overrides payload. 4. The server-side API endpoint accepts the request, committing the record to the database because it lacks a secondary validation check against the current organizational scope. 5. The arbitrary external user now possesses the specific granular permissions (e.g., channel.promote_bundle) associated with that channel.\nThis allows the unauthorized principal to interact with internal channels, potentially leading to unauthorized deployments, code promotion, or modification of administrative states that should be restricted to validated organization members. Since the application trusts the input without validating the principal's membership status, it facilitates a cross-tenant privilege escalation.\nThe exploit requires valid administrative authentication, meaning the threat vector is internal to the platform's trusted administrator group, emphasizing the risk of insider threats or compromised administrative accounts. Because the platform does not enforce strict scope isolation, the payload successfully bypasses security controls that are intended to contain permissions within the boundary of a single organization.\nThe technical failure is an Improper Authorization (CWE-285) arising from a failure to validate the relationship between the authenticated actor's organization and the specified target principal within the backend authorization schema."
}