CVE-2026-100617: Cap-Go Capgo.app

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.

Affected products

• Cap-Go Capgo.app: any version

Published 2026-09-26. Last modified 2026-09-30.