CVE-2026-100617

Name of the Vulnerable Software and Affected Versions capgo.app (affected versions not specified)

Description The application fails to validate that principals within channel permission overrides are members of the organization. This allows authenticated app or organization administrators to grant channel permissions to users outside the organization by inserting override rows with arbitrary external user UUIDs. This can lead to the unauthorized granting of channel-scoped permissions, such as channel.promote bundle.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.