CVE-2026-100627

Name of the Vulnerable Software and Affected Versions Capgo (Cap-go/capgo.app) server backend (affected versions not specified)

Description An incorrect authorization flaw exists in the API-key bundle promotion path. The 'PUT /bundle' endpoint, accessible to all and write API keys, utilizes the setChannel() function. This function performs authorization via checkPermission(c, 'channel.promote bundle', { appId: body.app id }) but fails to include the request's channel id. Consequently, the scope field is passed as SQL NULL to rbac check permission direct(), which prevents the evaluation of per-channel allow or deny overrides. Users with app-level channel.promote bundle permissions, such as those in the app developer and app uploader roles, can promote a bundle to a channel even if an explicit per-channel deny override is in place, allowing them to update public.channels.version for the specified channel id.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.