CVE-2026-100620

Executive Summary

CVE-2026-100620 is an over-permissioned service account vulnerability in the Capgo CLI npm package (@capgo/cli) through version 7.98.2. It affects developers and organizations using the CLI's Android onboarding flow via Google OAuth. The impact is a privilege boundary violation: the generated Google Play service account is granted account-wide draft app management permissions (CAN_MANAGE_DRAFT_APPS_GLOBAL) despite the user interface indicating release-only permissions for a single confirmed app. This allows anyone who obtains the generated service account key to create, edit, and delete draft apps across the entire Google Play developer account, violating the principle of least privilege and expanding the blast radius of a credential compromise.

Technical Analysis

The vulnerability resides in the Android onboarding flow of the Capgo CLI when authenticated via Google OAuth. The CLI automates the creation of a Google Play service account and invites it to the user's Google Play Console developer account. The core flaw is a mismatch between the permissions requested programmatically and those described to the user.

According to the NVD description, the CLI passes the permission CAN_MANAGE_DRAFT_APPS_GLOBAL in the developerAccountPermissions field of the Android Publisher API User create request. This is an account-wide permission that authorizes the service account to manage draft applications across the entire Google Play developer account, not just the specific app the user selected during onboarding. The user-facing flow, however, states that the service account is invited into a single confirmed app with release-only permissions. This constitutes a privilege escalation and a violation of the intended security boundary, classified as CWE-269 (Improper Privilege Management).

The attack surface is the Google OAuth onboarding process and the subsequent handling of the generated service account key, stored in the PLAY_CONFIG_JSON environment variable or file. The vulnerability is not remotely exploitable in the traditional network sense; an attacker must first obtain the service account key. However, the over-permissioning means that a compromise of this key grants far greater access than the user was led to believe. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) reflects that the attack vector is network-based (the Google API), requires high privileges (possession of the key), and results in low integrity and availability impact, with no confidentiality impact.

From a code-level perspective, the flaw is likely a misconfiguration in the API request payload. The correct permission for release-only access to a single app would be a scoped permission tied to the specific app ID, or a more restrictive account-level permission. The use of CAN_MANAGE_DRAFT_APPS_GLOBAL indicates that the developer either mistakenly used a global permission constant or intentionally bypassed the scoped permission logic, perhaps to simplify the onboarding process. No patched version was available at the time of publication, leaving all users of @capgo/cli through 7.98.2 vulnerable.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain is inferred from the vulnerability class (improper privilege management) and the NVD description.

1. Reconnaissance and Target Identification: An attacker identifies an organization or developer that uses the Capgo CLI for Android app deployment. This could be achieved through public code repositories, CI/CD logs, or social engineering. The attacker's goal is to locate the PLAY_CONFIG_JSON service account key, which is often stored insecurely in environment variables, configuration files, or CI/CD secrets.

2. Credential Acquisition: The attacker obtains the PLAY_CONFIG_JSON key. This could happen through a compromised CI/CD pipeline, a leaked repository, phishing, or insider access. Because the key is a long-lived credential, it remains valid until revoked.

3. Triggering the Flaw Class: With the service account key, the attacker authenticates to the Google Play Android Publisher API. They then invoke API endpoints to manage draft applications. Due to the over-permissioned CAN_MANAGE_DRAFT_APPS_GLOBAL permission, the API authorizes the attacker to create, edit, and delete draft apps across the entire Google Play developer account, not just the single app the key was intended for. The attacker does not need to exploit a software bug in the traditional sense; they simply use the excessive privileges granted by the misconfigured service account.

4. Post-Exploitation Impact: The attacker can create malicious draft apps, modify existing drafts to inject malware or phishing content, or delete drafts to disrupt business operations. They could also use the draft apps to distribute malware if they manage to publish them (though the permission is limited to drafts, publishing may require additional steps). The integrity and availability of the Google Play developer account are compromised. The attacker could also use the access to exfiltrate information about other apps, though confidentiality impact is rated as none in the CVSS vector.

Impact Assessment

The business impact is significant for organizations using the Capgo CLI. The over-permissioned service account violates the principle of least privilege, turning a single-app release credential into an account-wide draft management key. If compromised, an attacker can manipulate draft applications across the entire Google Play developer account. This could lead to reputational damage, loss of customer trust, and potential financial losses if malicious drafts are published or if the account is suspended by Google.

The CVSS score is 3.8 (Low), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. The low score is due to the high privileges required (PR:H) to exploit the vulnerability, meaning the attacker must already possess the service account key. However, the blast radius is larger than expected because the key grants more permissions than intended. The scope is unchanged (S:U), and there is no confidentiality impact (C:N), but integrity (I:L) and availability (A:L) are low impacted. The affected systems are the Google Play developer accounts of Capgo CLI users, and the blast radius includes all draft apps within those accounts. No CISA KEV listing, indicating no known active exploitation in the wild at the time of publication.

Detection Guidance

Sigma Rule

title: Capgo CLI Over-Permissioned Service Account Onboarding
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects the creation of a Google Play service account with the CAN_MANAGE_DRAFT_APPS_GLOBAL permission via the Android Publisher API, as performed by the Capgo CLI during Android onboarding.
author: Threat Intelligence Team
date: 2026-01-15
logsource:
    product: gcp
    service: audit
detection:
    selection:
        protoPayload.methodName: "google.developer.androidpublisher.v3.Users.Create"
        protoPayload.request.developerAccountPermissions: "CAN_MANAGE_DRAFT_APPS_GLOBAL"
    condition: selection
falsepositives:
    - Legitimate administrative actions that require account-wide draft management permissions.
level: high
tags:
    - attack.privilege_escalation
    - attack.t1078

YARA Rule

rule CVE_2026_100620_Capgo_CLI_Overpermission
{
    meta:
        description = "Detects the string CAN_MANAGE_DRAFT_APPS_GLOBAL in Capgo CLI configuration or logs, indicating the over-permissioned service account invitation."
        author = "Threat Intelligence Team"
        date = "2026-01-15"
        reference = "CVE-2026-100620"
        severity = "high"

    strings:
        $s1 = "CAN_MANAGE_DRAFT_APPS_GLOBAL" ascii wide
        $s2 = "developerAccountPermissions" ascii wide
        $s3 = "PLAY_CONFIG_JSON" ascii wide

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100620 Capgo CLI Over-Permissioned Service Account Onboarding"; flow:to_server,established; content:"POST"; http_method; content:"/androidpublisher/v3/applications/"; http_uri; content:"users"; http_uri; content:"developerAccountPermissions"; http_client_body; content:"CAN_MANAGE_DRAFT_APPS_GLOBAL"; http_client_body; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by user.id
  [any where event.action == "google.developer.androidpublisher.v3.Users.Create" and
   process.name == "node" and
   user_agent.original : "*@capgo/cli*"]
  [any where event.action == "google.developer.androidpublisher.v3.Edits.Insert" and
   user_agent.original : "*@capgo/cli*"]

Splunk SPL Query

index=gcp_audit sourcetype=google:gcp:pubsub:message
| search protoPayload.methodName="google.developer.androidpublisher.v3.Users.Create"
| search protoPayload.request.developerAccountPermissions="CAN_MANAGE_DRAFT_APPS_GLOBAL"
| table _time, protoPayload.authenticationInfo.principalEmail, protoPayload.request.developerAccountPermissions, protoPayload.resourceName
| sort - _time

Wazuh OSSEC Rule

<group name="gcp_audit,">
  <rule id="100620" level="12">
    <decoded_as>json</decoded_as>
    <field name="protoPayload.methodName">google.developer.androidpublisher.v3.Users.Create</field>
    <field name="protoPayload.request.developerAccountPermissions">CAN_MANAGE_DRAFT_APPS_GLOBAL</field>
    <description>CVE-2026-100620: Capgo CLI created a service account with account-wide draft management permissions.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Audit existing Google Play service accounts created via Capgo CLI. Identify any accounts with the CAN_MANAGE_DRAFT_APPS_GLOBAL permission and revoke or reduce their permissions to the minimum required for release management.
   • Rotate all PLAY_CONFIG_JSON service account keys. Assume any key generated by the vulnerable CLI is over-permissioned and potentially compromised.
   • Implement strict access controls on CI/CD systems to prevent unauthorized access to service account keys.
   • Monitor Google Play Console audit logs for unexpected draft app creation or modification.

2. Patch/Upgrade Steps:

   • No patched version is available. Monitor the Capgo CLI GitHub repository and npm package for updates. Once a patched version is released, upgrade immediately.
   • As a temporary workaround, manually adjust the service account permissions in the Google Play Console after onboarding to restrict access to the specific app and release-only permissions.
   • Consider using alternative deployment methods that do not rely on the vulnerable onboarding flow.

3. Long-term Hardening:

   • Enforce the principle of least privilege for all service accounts. Regularly review and audit permissions.
   • Use short-lived credentials or workload identity federation instead of long-lived service account keys where possible.
   • Implement automated permission validation in CI/CD pipelines to detect over-permissioned accounts.
   • Educate developers on the risks of over-permissioned service accounts and the importance of verifying permission scopes.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-100620
• Capgo CLI npm Package: https://www.npmjs.com/package/@capgo/cli
• Google Play Android Publisher API Documentation: https://developers.google.com/android-publisher
• CWE-269: Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• CISA KEV Catalog: Not listed (as of 2026-01-15)