Cap-go’s Capgo backend contains an RBAC flaw in the /bundle PUT endpoint that allows any user with write permissions to promote a bundle to a channel, even when an explicit per‑channel deny override exists. The flaw arises because the channel identifier is omitted from the permission check, rendering channel‑level overrides ineffective and permitting privileged actors to elevate their authorization through the app‑level channel.promote_bundle permission. This can enable malware or malicious updates to be pushed to a channel that should have been protected, compromising data integrity and potentially affecting end users.

The vulnerability affects all installations of Cap-go’s Capgo server, specifically the Supabase functions that expose the /bundle API. It is present in the main branch as of commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely older releases, with no patched version available at time of disclosure.

The CVSS v3.1 score of 7.2 indicates a high impact, and although the EPSS score is not available, the vulnerability is exploitable by any party that can obtain an 'all' or 'write' API key, which is common for regular application developers. The KEV status is not listed, but given the high score and the ability to bypass channel‑level controls, the risk warrants prompt assessment and mitigation. The attack vector is an authenticated API call; the prerequisite is possession of an API key with write authorization, which can be obtained through legitimate use or compromise of application credentials.