Description
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.
Published: 2026-09-26
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Management of Google Play Developer Account
Action: Apply Workarounds
AI Analysis

Impact

Capgo CLI up to version 7.98.2 incorrectly grants Google Play service accounts full developer permissions during Android onboarding. The CLI invites the service account with the global CAN_MANAGE_DRAFT_APPS_GLOBAL permission, even though the user interface states the account is limited to a single app with release-only rights. This mismatch enables anyone in possession of the service account key to create, edit, and delete draft applications for the entire Google Play developer account, compromising application integrity and potentially facilitating malicious releases.

Affected Systems

Affected deployment is Capgo CLI, a JavaScript package named @capgo/cli, for all releases up to and including 7.98.2. No subsequent versions are listed as fixed.

Risk and Exploitability

The attack likely requires possession of the service account key, which could be obtained through compromised Google OAuth flows or insider access, and does not rely on network vulnerabilities in the CLI itself. The CVSS score of 5.1 indicates moderate severity, the EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. However, the ability to manipulate all draft applications within a developer account makes this flaw potentially high impact to a developer’s application pipeline.

Generated by OpenCVE AI on September 26, 2026 at 14:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Remove the over‑permissioned service account from the Play Console and delete the associated key file.
  • Generate a new service account with only the required permissions for the specific app and update the Capgo CLI configuration.
  • Verify that API calls no longer include global routes or permission scopes.
  • Upgrade Capgo CLI to the latest release once a patch is available; monitor the project’s release notes for a fix.

Generated by OpenCVE AI on September 26, 2026 at 14:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.
Title Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-26T13:29:44.936Z

Reserved: 2026-09-26T02:31:07.602Z

Link: CVE-2026-100620

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-26T14:16:42.877

Modified: 2026-09-26T14:16:42.877

Link: CVE-2026-100620

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T14:45:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management