Description
Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated user holding only apikey_manager (permissions org.manage_apikeys and org.read) calls POST /apikey with a JWT session, the only checks applied are the org.manage_apikeys permission, a fixed deny-list of assignable role names (APIKEY_MANAGER_DENIED_ASSIGNABLE_ROLES in public/apikey/scope.ts), and a priority-rank comparison in createRoleBindingForPrincipal (private/role_bindings.ts). No check verifies that the caller actually holds the permissions conferred by the role being assigned. Because the deny-list omits the deploy roles app_developer, app_uploader, channel_developer and channel_uploader, and apikey_manager is seeded with priority_rank 78 — higher than those roles' ranks (68, 66, 58, 57) — the rank check also passes. As a result, an apikey_manager who cannot upload bundles or promote channels can mint an API key bound to a deploy role and use it to push arbitrary OTA JavaScript updates to all end users of the organization's apps. As of the advisory publication no patched version was available.
Published: 2026-09-26
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation via API Key Assignment
Action: Immediate Patch
AI Analysis

Impact

An authenticated user with the apikey_manager role is able to create API keys bound to higher‐rank deploy roles because the check that the caller carries the permissions of the role being assigned is missing. The exploit allows the attacker to craft keys that can push unrelated OTA JavaScript updates to all users of the organization’s apps.

Affected Systems

Capgo backend (capgo.app) versions 12.261.0 and earlier.

Risk and Exploitability

The vulnerability scores 7.1 on CVSS; EPSS data is not available and it is not in the KEV list. Attack requires authentication as an apikey_manager user and the use of the POST /apikey endpoint with a JWT session. Once exploited, the attacker can issue deploy‑role API keys and execute arbitrary updates, compromising confidentiality, integrity, and availability for end users. Due to the lack of a current public fix, the risk remains high until a patched release is deployed.

Generated by OpenCVE AI on September 26, 2026 at 14:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch after it becomes available; normally a newer Capgo backend version will contain the fix.
  • Only assign the apikey_manager role to trusted administrators and revoke it for any user that does not need to create API keys.
  • Add a runtime verification that the requested role’s required permissions are a subset of the requester’s permissions or extend the deny‑list to include the deploy roles before creating the key.

Generated by OpenCVE AI on September 26, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated user holding only apikey_manager (permissions org.manage_apikeys and org.read) calls POST /apikey with a JWT session, the only checks applied are the org.manage_apikeys permission, a fixed deny-list of assignable role names (APIKEY_MANAGER_DENIED_ASSIGNABLE_ROLES in public/apikey/scope.ts), and a priority-rank comparison in createRoleBindingForPrincipal (private/role_bindings.ts). No check verifies that the caller actually holds the permissions conferred by the role being assigned. Because the deny-list omits the deploy roles app_developer, app_uploader, channel_developer and channel_uploader, and apikey_manager is seeded with priority_rank 78 — higher than those roles' ranks (68, 66, 58, 57) — the rank check also passes. As a result, an apikey_manager who cannot upload bundles or promote channels can mint an API key bound to a deploy role and use it to push arbitrary OTA JavaScript updates to all end users of the organization's apps. As of the advisory publication no patched version was available.
Title Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-26T13:22:53.315Z

Reserved: 2026-09-26T02:30:34.353Z

Link: CVE-2026-100611

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-26T14:16:41.610

Modified: 2026-09-26T14:16:41.610

Link: CVE-2026-100611

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T15:00:14Z

Weaknesses
  • CWE-269

    Improper Privilege Management