CVE-2026-100627

Executive Summary

CVE-2026-100627 is an incorrect authorization flaw (CWE-639) in the Capgo server backend, specifically in Supabase functions handling the API-key bundle promotion path. A principal holding app-level channel.promote_bundle permission can bypass explicit per-channel deny overrides and promote a bundle to a channel via the PUT /bundle endpoint. Successful exploitation allows unauthorized modification of public.channels.version for a supplied channel_id, potentially delivering untrusted code updates to production applications, with high integrity and availability impact but no confidentiality impact (CVSS 8.1).

Technical Analysis

The vulnerability resides in the authorization logic of the Capgo backend Supabase functions, which process requests to the PUT /bundle endpoint under API keys scoped as "all" or "write". When this endpoint is invoked, the request is dispatched to the internal function setChannel. The critical flaw is that setChannel calls checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) while omitting the request's channel_id field from the authorization scope. This omission is significant because the omitted scope field is subsequently passed to rbac_check_permission_direct as SQL NULL.

The role-based access control (RBAC) implementation contains a gating condition: per-channel override evaluation is only performed when p_channel_id IS NOT NULL. Because the channel_id is omitted and therefore arrives as NULL, the system skips evaluation of per-channel allow/deny overrides entirely. This means that an explicit per-channel deny override—which should block promotion of bundles to a specific channel—is never consulted during the authorization decision.

Consequently, an authenticated principal assigned the app_developer or app_uploader role, both of which are granted app-level channel.promote_bundle permission by default, can successfully promote a bundle to any channel within the application, even when an explicit per-channel deny rule exists for that channel. The target channel is only validated after authorization has already succeeded, resulting in a time-of-check to time-of-use (TOCTOU) style ordering flaw. Successful exploitation directly updates the public.channels.version value for the supplied channel_id, enabling an attacker to force the application to serve a different bundle version than intended.

This is a classic broken access control issue: the authorization check relies on a parameter that is not supplied, so the default (permissive) path is taken instead of the explicit restriction. The vulnerability is confirmed on the main branch at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely affects earlier versions. No patched version is available.

Exploitation Scenarios

1. Reconnaissance and target identification: An attacker first obtains valid API credentials associated with the app_developer or app_uploader role for a target Capgo application. These roles are commonly assigned to developers or CI/CD pipelines, meaning credentials may be available through compromised developer accounts, leaked tokens, or supply chain access. The attacker identifies channels where a per-channel deny override exists—for example, a production or stable release channel that restrict promotion of unvetted bundles.

2. Triggering the authorization bypass: The attacker sends a crafted PUT /bundle request to the Capgo server backend. The request includes a valid app_id and the channel_id of the protected channel, along with the bundle to be promoted. Because the API key has the "write" or "all" scope, the request is accepted for processing and dispatched to setChannel.

3. Exploiting the missing scope field: Inside setChannel, the authorization check checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) is executed. Critically, the channel_id is not included in the scope object. When this is passed to rbac_check_permission_direct, the missing parameter becomes SQL NULL. The RBAC logic then skips evaluation of per-channel overrides because the gating condition p_channel_id IS NOT NULL evaluates to false. The app-level permission (which the role possesses by default) is therefore sufficient, and the per-channel deny override is ignored.

4. Post-exploitation impact: The authorization check passes, and the system proceeds to update public.channels.version for the attacker-supplied channel_id. The target channel is validated only after authorization, so the promotion succeeds. The attacker has now modified the bundle version served to clients on that channel, effectively enabling injection of arbitrary or malicious code updates into the application’s update stream. This can lead to remote code execution in dependent applications, data exfiltration, or persistent backdooring of the app’s update mechanism. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The CVSS 3.1 base score is 8.1 (High). The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H indicates:

• Attack Vector (Network): Exploitable remotely over the network.
• Attack Complexity (Low): No special conditions or race conditions are required; the flaw is deterministic.
• Privileges Required (Low): The attacker must possess a valid API key with "all" or "write" scope and an account with the app_developer or app_uploader role.
• User Interaction (None): No victim interaction is needed.
• Scope (Unchanged): The impact is confined to the vulnerable component.
• Confidentiality (None): The vulnerability does not directly expose sensitive data.
• Integrity (High): The attacker can arbitrarily modify the channel version, altering the code served to clients.
• Availability (High): Promoting a broken or malicious bundle can render the application unusable for all users on the affected channel.

The blast radius includes any Capgo-hosted application where the attacker holds a low-privileged developer/uploader role and where per-channel deny overrides are configured as a security control. Because Capgo is used for over-the-air updates in mobile and web applications, a successful exploit can compromise the entire user base of the affected app. The lack of confidentiality impact is overshadowed by the severe integrity and availability consequences, making this a high-severity threat for software supply chain integrity.

Detection Guidance

Sigma Rule

title: Capgo Incorrect Authorization - Bundle Promotion to Denied Channel
id: 8f2a1c3e-5b7d-4a9f-8c1e-2d3f4a5b6c7d
status: experimental
description: Detects exploitation attempts of CVE-2026-100627 where a PUT /bundle request bypasses per-channel deny overrides.
author: valtersit.com
date: 2026-01-01
logsource:
  product: capgo
  service: supabase-functions
detection:
  selection:
    http.method: 'PUT'
    http.url: '/bundle'
    http.status: 200
  filter_legit:
    channel_id: null
  condition: selection and not filter_legit
falsepositives:
  - Legitimate bundle promotions where channel_id is intentionally omitted (unlikely)
level: high
tags:
  - attack.t1548
  - cve.2026.100627

YARA Rule

rule CVE_2026_100627_Capgo_Auth_Bypass
{
    meta:
        description = "Detects Capgo backend requests exploiting CVE-2026-100627"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100627"
        severity = "high"
    strings:
        $s1 = "PUT /bundle" ascii wide nocase
        $s2 = "channel.promote_bundle" ascii wide nocase
        $s3 = "setChannel" ascii wide nocase
        $s4 = "app_developer" ascii wide nocase
        $s5 = "app_uploader" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100627 Capgo Bundle Promotion Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/bundle"; http.header; content:"authorization"; nocase; pcre:"/channel_id\x22?\s*:\s*\d+/Ri"; reference:cve,2026-100627; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100627; classtype:attempted-admin; sid:1000627; rev:1;)

Elastic Detection

sequence by process.entity_id
  [http where http.request.method == "PUT" and http.request.path == "/bundle" and
   http.response.status_code == 200 and
   not http.request.body contains "channel_id"]

Splunk SPL Query

index=web sourcetype=capgo:access
| search http_method=PUT uri_path="/bundle" http_status=200
| rex field=request_body "\"channel_id\"\s*:\s*(?<channel_id>\d+)"
| where isnull(channel_id)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, app_id
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="capgo,">
  <rule id="100627" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">PUT</field>
    <field name="http.url">/bundle</field>
    <field name="http.status">200</field>
    <description>CVE-2026-100627: Capgo bundle promotion authorization bypass - per-channel deny override ignored</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>capgo,access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable the PUT /bundle endpoint for API keys scoped as "write" or "all" where per-channel deny overrides are required, until a patch is available.
   • Audit and restrict the app_developer and app_uploader roles to only trusted users and CI/CD systems; remove these roles from any accounts not strictly requiring bundle promotion.
   • Implement network-level filtering to restrict access to the Supabase functions endpoint to known IP ranges or VPN clients.
   • Monitor logs for PUT /bundle requests that omit the channel_id in the request body but successfully update public.channels.version.

2. Patch/upgrade steps:

   • No vendor patch is currently available. Track the Capgo repository (Cap-go/capgo.app) for a fix that properly includes channel_id in the checkPermission scope object, ensuring rbac_check_permission_direct receives a non-null p_channel_id and evaluates per-channel overrides.
   • Once a patch is released, upgrade all Capgo server backend deployments immediately. Verify the fix by testing that a per-channel deny override correctly blocks bundle promotion by a user with only app-level channel.promote_bundle permission.

3. Long-term hardening:

   • Enforce the principle of least privilege for API keys and service accounts; avoid issuing "all" scope keys to automated systems.
   • Require explicit channel_id in all bundle promotion requests and reject requests that omit it at the API gateway level.
   • Implement automated regression tests that verify RBAC overrides are enforced under all scope permutations, including missing channel identifiers.
   • Adopt a defense-in-depth approach: validate channel authorization independently in the business logic layer, not solely in the RBAC middleware.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-100627
• https://github.com/Cap-go/capgo.app (commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and prior versions)
• https://cwe.mitre.org/data/definitions/639.html (CWE-639: Authorization Bypass Through User-Controlled Key)
• https://attack.mitre.org/techniques/T1548/ (MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism)
• No public proof-of-concept, exploit code, or active exploitation campaigns are known at the time of publication. CISA KEV does not list this CVE.