Medium severity6.3NVD Advisory· Published Sep 10, 2026· Updated Sep 10, 2026

CVE-2026-88860

Description

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cap Go/Capgo.appinferred2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/Cap-go/capgo.app/security/advisories/GHSA-qfxq-2ch8-hjg9nvd
www.vulncheck.com/advisories/capgo-authorization-bypass-via-stale-channel-permission-overridesnvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000