High severity8.8NVD Advisory· Published Sep 26, 2026· Updated Sep 30, 2026
CVE-2026-100617
CVE-2026-100617
Description
Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Capgo.app: 19 Vulnerabilities Disclosed in Single Batch, Highlighting Authorization FlawsVypr Intelligence · Sep 26, 2026