CVE-2026-100617

Executive Summary

CVE-2026-100617 is an improper authorization vulnerability (CWE-862) in Cap-go's capgo.app platform, where the application fails to validate that principals listed in channel_permission_overrides belong to the same organization. An authenticated attacker holding app- or organization-level administrative privileges can insert override rows referencing arbitrary external user UUIDs, thereby granting channel-scoped permissions — such as channel.promote_bundle — to users outside the organization. With a CVSS base score of 8.8, successful exploitation results in high confidentiality, integrity, and availability impact across the affected tenant, enabling cross-tenant privilege escalation and unauthorized access to release/bundle promotion workflows.

Technical Analysis

The vulnerability resides in the authorization logic governing channel_permission_overrides, a data structure used by capgo.app to assign channel-scoped permissions to principals. The core defect is a missing ownership/membership check: when an administrative principal (app admin or org admin) creates an override entry, the application does not verify that the referenced user UUID corresponds to a member of the same organization. Because the principal identifier is accepted as an arbitrary external UUID, the trust boundary between organizations is effectively bypassed.

From an authorization-model perspective, this is a classic case of broken object-level / relationship-level authorization. The application enforces a role check (the caller must be an admin) but omits a relationship check (the target principal must be an org member). The result is that an admin's legitimate privilege to manage channel permissions is over-scoped: they can confer those permissions on identities that were never part of their tenant.

The NVD description explicitly names channel.promote_bundle as an example of the channel-scoped permission that can be granted. This implies the override table maps a channel, a principal (user UUID), and a permission verb. Any permission modeled in this override system is potentially grantable to an external UUID, making the flaw general rather than limited to a single permission.

No further code-level detail is available. No public proof-of-concept, exploit code, or Nuclei template exists, so the exact request format, endpoint, and parameter names cannot be confirmed. The mechanism is inferred strictly from the vulnerability class (CWE-862) and the description provided.

Exploitation Scenarios

1) Reconnaissance / target identification. The attacker first obtains a valid account with administrative privileges on a capgo.app tenant — either as an app admin or an org admin. This is the baseline precondition (CVSS PR:L). The attacker enumerates available channels and their associated permission model through normal administrative interfaces.

2) Triggering the flaw. The attacker submits an action that creates a channel_permission_overrides entry, supplying a principal UUID that is not a member of their organization. Because the application fails to validate org membership of that principal, the override is accepted. No public PoC is available; the attack chain is inferred from the vulnerability class (missing authorization / CWE-862).

3) Payload / execution method (class level). The payload is the override row itself: a channel identifier, an external user UUID, and a permission value (e.g., channel.promote_bundle). The attack is executed through the normal authenticated administrative API surface used to manage channel permissions; no memory corruption, injection, or special encoding is required.

4) Post-exploitation impact. Once the override is persisted, the external (non-member) user gains channel-scoped permissions they were never entitled to. With channel.promote_bundle, the external user could promote bundles within the channel — i.e., influence what code/artifact is served to app clients. This constitutes unauthorized cross-organization privilege grant and potential integrity compromise of the release pipeline.

Impact Assessment

• Confidentiality (C:H): External principals can be granted access to channel-scoped resources they should not reach, exposing tenant data and release content.
• Integrity (I:H): The ability to grant channel.promote_bundle and similar permissions lets an unauthorized party alter which bundles are promoted, compromising artifact integrity.
• Availability (A:H): Misconfigured or malicious overrides can disrupt channel operations for legitimate users, and malicious promotion can render clients unable to load correct bundles.
• Scope (S:U): The vulnerable component and impacted component are treated as the same authorization scope, per the vector.

Affected systems: capgo.app tenants using channel_permission_overrides for channel permission management. Blast radius: any organization whose admin account is compromised or malicious, extending beyond the tenant boundary to any external UUID targeted. Because attackers require admin privileges (PR:L) but no user interaction (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L), the 8.8 base score reflects a severe, readily exploitable authorization defect. There is no evidence of CISA KEV listing or in-the-wild exploitation at this time, and EPSS remains unscored.

Detection Guidance

Sigma Rule

title: Cap-go Channel Permission Override Granted to Non-Member Principal
id: 8f3a2c91-4d7e-4b6a-9c11-2f5e6a7b8c90
status: experimental
description: Detects creation/update of channel_permission_overrides referencing a principal outside the organization in capgo.app
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100617
author: valtersit.com
date: 2026-01-01
logsource:
  product: capgo
  service: audit
detection:
  selection_action:
    action|contains:
      - 'channel_permission_overrides'
      - 'channel.permission_override'
  selection_perm:
    permission|contains:
      - 'channel.promote_bundle'
  condition: selection_action or selection_perm
falsepositives:
  - Legitimate admin operations within the same organization
level: high

YARA Rule

rule CVE_2026_100617_Channel_Permission_Override
{
    meta:
        description = "Detects references to channel_permission_overrides with external principal indicators"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100617"
        date = "2026-01-01"
    strings:
        $s1 = "channel_permission_overrides" ascii nocase
        $s2 = "channel.promote_bundle" ascii nocase
        $s3 = "principal_id" ascii nocase
        $s4 = "user_uuid" ascii nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100617 Cap-go Channel Permission Override to Non-Member Principal"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"channel_permission_overrides"; nocase; http.request_body; content:"channel.promote_bundle"; nocase; reference:cve,2026-100617; classtype:attempted-admin; sid:2026100617; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [any where event.action : "channel.permission_override.create"]
  [any where process.name : "*" and user.id : "*" and not user.roles : "org_member"]

Splunk SPL Query

index=capgo sourcetype=capgo:audit (action="channel_permission_override.create" OR action="channel_permission_overrides")
| where match(permission, "channel\.")
| lookup org_members user_uuid OUTPUT is_member
| where isnull(is_member) OR is_member=0
| table _time, user, org_id, channel_id, principal_uuid, permission
| sort - _time

Wazuh OSSEC Rule

<group name="capgo,web,">
  <rule id="100617" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">channel_permission_override.*</field>
    <field name="permission">channel\.promote_bundle</field>
    <description>CVE-2026-100617: Channel permission override granted to potential non-member principal in capgo.app</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and no vendor fix or workaround has been published.

1) Immediate mitigations:

• Restrict and audit all accounts holding app- or org-admin privileges; apply least privilege and just-in-time elevation.
• Review and clean existing channel_permission_overrides rows, removing any principal UUID not belonging to the organization.
• Enforce a compensating authorization check at the API gateway or middleware layer where possible, validating that the referenced principal is an org member before persisting an override.
• Enable verbose audit logging on all permission-override mutations and alert on any override granting channel.promote_bundle or similar permissions.

2) Patch / upgrade steps:

• No patch is currently available. Monitor the capgo.app vendor advisory channel and NVD entry for a fixed release.
• When a patch is released, upgrade immediately and re-validate all existing override entries post-upgrade.

3) Long-term hardening:

• Implement server-side relationship checks (principal must belong to the requesting organization) as a mandatory invariant in the authorization model.
• Adopt automated authorization testing (e.g., relationship-based access control test suites) to catch missing membership validation.
• Apply cross-tenant isolation reviews to all permission-granting endpoints.

References

• NVD — CVE-2026-100617
• CWE-862: Missing Authorization
• MITRE ATT&CK T1078 — Valid Accounts
• FIRST EPSS — CVE-2026-100617 not yet scored
• CISA KEV Catalog — CVE-2026-100617 is NOT listed; no confirmed in-the-wild exploitation or threat actor campaign evidence is available at this time.