CVE-2026-100620

Name of the Vulnerable Software and Affected Versions Capgo CLI versions prior to 7.98.3

Description The Android onboarding flow contains an over-permissioned service account. During Google OAuth onboarding, the CLI assigns the CAN MANAGE DRAFT APPS GLOBAL permission (passed via the developerAccountPermissions parameter in the Android Publisher API User create request) to the generated Google Play service account. This contradicts the user-facing flow, which indicates the account is limited to a single app with release-only permissions. Consequently, an individual possessing the PLAY CONFIG JSON service account key can create, edit, and delete draft applications across the entire Google Play developer account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.