Description

Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-09-26T14:16:42.877Z",
  "pubdate": "2026-09-26T14:16:42.877Z",
  "executiveSummary": "The Capgo CLI (npm package @capgo/cli) through version 7.98.2 suffers from an improper authorization vulnerability within its Android onboarding workflow.\nDuring Google OAuth integration, the application generates a Google Play service account intended for limited scope access; however, it incorrectly assigns account-wide permissions via the Android Publisher API.\nThe vulnerability type is categorized as an over-privileged service account assignment, granting the service account the 'CAN_MANAGE_DRAFT_APPS_GLOBAL' permission.\nThis flaw allows any actor possessing the 'PLAY_CONFIG_JSON' file to perform unauthorized administrative actions, including the creation, modification, and deletion of draft applications across the entire Google Play Developer account, rather than being restricted to a specific package.\nThe risk is severe, as it exposes the integrity of the entire developer organization's application portfolio to potential compromise if the service account key is leaked or stolen.\nThere is currently no patched version available, necessitating immediate manual remediation by affected developers to restrict service account scopes.",
  "technicalDetails": "The vulnerability originates in the Android onboarding logic of the @capgo/cli, specifically during the interaction with the Google Play Developer API to create a new service account user.\nWhen a user triggers the onboarding flow, the CLI facilitates a process to grant the tool access to the Google Play Console. While the user-facing interface indicates that the service account will be provisioned with granular, release-only permissions scoped to a single confirmed application, the underlying implementation fails to enforce this restriction.\nThe root cause is an insecure API call parameter configuration where the tool sends the 'developerAccountPermissions' field containing 'CAN_MANAGE_DRAFT_APPS_GLOBAL' in the User create request. This explicitly overrides the Principle of Least Privilege by granting global draft management rights to the service account across the entire Developer Account organization.\nThe attack flow proceeds as follows: First, an attacker must acquire the 'PLAY_CONFIG_JSON' file, which is typically stored by the user on their local machine or CI/CD environment after the onboarding flow completes. Second, because the service account is globally permitted for draft management, the attacker does not need to compromise the primary developer account.\nUsing the stolen credentials, an attacker can authenticate to the Google Play Publisher API using the provided OAuth2 flow. Once authenticated, the attacker can iterate through the developer account's entire app inventory, create unauthorized draft applications, inject malicious code into existing drafts, or delete legitimate drafts to disrupt operations.\nThe vulnerability is inherent to the logic executed by the @capgo/cli during the setup phase. It affects all versions up to 7.98.2. Exploitation does not require network-level access to the internal infrastructure, as the API interactions occur over standard HTTPS protocols (TLS-encrypted) directly with Google's public endpoints.\nThe impact is significant: the 'PLAY_CONFIG_JSON' file effectively acts as a long-lived credential that carries excessive authorization. An attacker with this file gains the same functional reach as a high-level developer within the Console, specifically for draft application lifecycle management. Because the scope is account-wide, the impact is not limited to the intended 'single app' target, but effectively puts the entire portfolio at risk of unauthorized code ingestion or administrative sabotage."
}