CVE-2026-88860

Executive Summary

CVE-2026-88860 is an authorization improvement defect (CWE-863: Incorrect Authorization) in Capgo, an over-the-air (OTA) update distribution platform. The vulnerability causes channel permission overrides to persist after a user's last organization role binding is deleted, leaving those stale overrides active. A formerly privileged or restricted user can therefore retain channel-specific permissions — including the ability to modify production OTA versions — even though their base role-based access control (RBAC) grant has been revoked. With a CVSS base score of 6.3 (Medium), the flaw requires an authenticated actor and yields limited confidentiality, integrity, and availability impact, but the integrity exposure is operationally significant because it enables unauthorized changes to production update streams.

Technical Analysis

The defect resides in Capgo's permission lifecycle management. Capgo applies Role-Based Access Control at the organization level and additionally permits granular, per-channel permission overrides that can grant or restrict actions on individual update channels. The authorization model therefore has two layers: (1) base RBAC derived from organization role bindings, and (2) channel-scoped overrides that layer on top of the base grants.

Per the NVD description, the implementation fails to clean up channel permission overrides when a user's last organization role binding is deleted. The intended semantic is that removing the final organization role binding should fully deprovision the user — the base grant disappears and any derived or dependent permissions must be invalidated. Instead, the channel-scoped overrides survive the deletion event. Because those overrides are evaluated as part of the authorization decision, a user who no longer holds any organization role can continue to satisfy the channel-level checks. This is a classic stale-authorization / orphaned-ACL condition: a revoke operation does not cascade to a secondary permission store, so the effective permission set is larger than the intended one.

The root cause class is incorrect authorization (CWE-863) resulting from incomplete state cleanup during deprovisioning. The vulnerable attack surface is any authenticated pathway that performs channel-scoped actions and relies on the override store rather than a fresh recomputation of the user's effective permissions from current organization role bindings. Notably, the description does not disclose specific endpoints, API routes, database tables, or function names; accordingly, no implementation-level identifiers are asserted here. The CWE, CVSS vector, and the explicit example action — "changing production OTA versions" — are the only implementation-anchored facts available.

Because Capgo is fundamentally an update-delivery system, the channel is the trust boundary for code distribution to end-user applications. Permission to a channel is therefore effectively permission to influence the software supply path for every client subscribed to that channel. This elevates the significance of an authorization bypass that, on its own CVSS merits, appears only moderate.

CVSS vector analysis: AV:N reflects remote reachability (the API/web interface is network-exposed). AC:L indicates no special conditions are needed beyond the state of the data. PR:L confirms a low-privileged authenticated account — or, in this case, a deprovisioned account that retains stale privileges — is sufficient. UI:N means no victim interaction is required. S:U scopes impact to the Capgo authorization context. C:L/I:L/A:L indicates limited but non-negligible impact across all three CIA pillars, consistent with unauthorized modification of a subset of update artifacts rather than full platform compromise.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (CWE-863) and the NVD description; no public PoC, exploit code, or Nuclei template exists, and no specific endpoint or parameter names are disclosed. The following is described at the vulnerability-class level only.

1. Reconnaissance / target identification. An adversary identifies a Capgo instance in use by a target organization. The attacker either already holds a Capgo account within that organization (legitimate or purchased credentials) or has had one provisioned previously. The most favorable precondition for this specific flaw is that the attacker previously held an organization role binding and was granted channel overrides during that tenure.

2. Triggering the vulnerability class. The prerequisite state change is the deletion of the attacker's last organization role binding. This may occur through a deliberate revocation by an administrator (offboarding) or through normal account lifecycle changes. Because the implementation does not clean up channel permission overrides on this deletion, the overrides remain attached to the actor. No exploit payload is required to reach this state — it is a passive residue of an administrative action.

3. Payload / execution at the class level. Following revocation, the attacker re-authenticates (or continues a session, subject to session controls) and issues requests for channel-scoped operations. The authorization layer evaluates the orphaned overrides and permits operations that should have been denied. The NVD description explicitly cites "changing production OTA versions" as an unauthorized action available to the attacker. Concretely, this means the attacker can direct or alter which update artifact is served on a production channel.

4. Post-exploitation impact. By manipulating production OTA versions, the attacker can push an unauthorized or malicious update payload to client applications enrolled on the affected channel. This is a supply-chain-adjacent outcome: clients trust the channel as the source of signed/legitimate updates, so a manipulated version can achieve code delivery at scale. Secondary impacts include silent rollback to a vulnerable release, version-pinning sabotage, availability disruption via malformed updates, or selective targeting if the attacker can choose which version identifier is served.

A distinct, lower-effort variant: an insider who is being offboarded retains the ability to modify production channels during the window before other controls (e.g., full session invalidation, credential rotation, account deletion) take effect. Where such controls are absent or delayed, the override persistence directly defeats the offboarding process.

Impact Assessment

Confidentiality (Low): The stale overrides may expose channel metadata or update artifacts to a user who should have no visibility. Scope is limited to channels for which overrides existed.

Integrity (Low–Material): The most consequential dimension. Unauthorized modification of production OTA versions corrupts the integrity of the update channel and, transitively, of every downstream client that consumes it. Even a "Low" subscore under CVSS can translate to a high-severity supply-chain event depending on deployment scale.

Availability (Low): Pushing a malformed or conflicting update can disrupt client applications, forcing crashes or failed update loops.

Blast radius. Directly impacted: the Capgo organization and its configured channels, specifically any channel for which the actor held overrides. Secondary: all client applications and end users subscribed to compromised production channels — potentially a very large population given the nature of OTA distribution. The PR:L and AV:N characteristics mean the population of potential actors includes every previously-provisioned user whose deprovisioning left overrides behind, not just a single targeted individual.

Business impact. Unauthorized code delivery to production endpoints undermines release integrity, may trigger regulatory and customer-notification obligations, and erodes trust in the update pipeline. Because Capgo is commonly used to ship mobile and web client updates, a single compromised channel can propagate to an entire installed base.

Detection Guidance

Because no public exploit exists and no endpoint specifics are disclosed, the detections below target the authorization-anomaly class: channel-scoped privileged actions performed by actors without an active organization role binding (or immediately following a role-binding deletion). Analysts should tune field names to their actual Capgo deployment schema.

Sigma Rule

title: Capgo Stale Channel Permission Override Abuse
id: 7c1f9a20-capgo-stale-override-001
status: experimental
description: Detects channel-scoped modifications following deletion of a user's last organization role binding, indicating abuse of stale channel permission overrides (CVE-2026-88860).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88860
author: valtersit.com
date: 2026/01/01
tags:
  - attack.persistence
  - attack.t1078
logsource:
  product: capgo
  category: audit
detection:
  selection_role_delete:
    action:
      - 'organization.role_binding.delete'
      - 'org_role_binding.remove'
      - 'role_binding.deleted'
  selection_channel_modify:
    action:
      - 'channel.update'
      - 'channel.version.publish'
      - 'channel.override.set'
      - 'ota.version.change'
  condition: selection_role_delete followed_by selection_channel_modify within 24h
fields:
  - actor_id
  - organization_id
  - channel_id
  - action
falsepositives:
  - Legitimate immediate re-provisioning where a new role binding is created in the same window
level: high

YARA Rule

rule CVE_2026_88860_Capgo_Stale_Override
{
    meta:
        description = "Flags Capgo audit/application logs referencing channel override changes after role-binding deletion; CVE-2026-88860"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88860"
        date = "2026-01-01"
        severity = "high"

    strings:
        $reva = "role_binding" ascii nocase
        $revb = "role-binding" ascii nocase
        $chana = "channel_permission" ascii nocase
        $chanb = "channel permission override" ascii nocase
        $chanc = "channelOverride" ascii nocase
        $ota  = "ota" ascii nocase
        $ver  = "production" ascii nocase

    condition:
        (any of ($reva, $revb)) and
        (any of ($chana, $chanb, $chanc)) and
        filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-88860 Possible Capgo Stale Channel Override Modification"; \
  flow:established,to_server; \
  http.method; content:"PUT"; \
  http.uri; content:"channel"; nocase; \
  http.request_body; content:"override"; nocase; \
  http.request_body; content:"production"; nocase; \
  reference:cve,CVE-2026-88860; \
  classtype:attempted-user; \
  sid:2026888601; rev:1; \
  metadata:service http; )

Elastic Detection

sequence by user.id with maxspan=24h
  [ audit where event.action in
      ("organization.role_binding.delete", "role_binding.deleted",
       "org_role_binding.remove") ]
  [ audit where event.action in
      ("channel.update", "channel.version.publish",
       "channel.override.set", "ota.version.change")
      and user.roles : null ]

Splunk SPL Query

index=capgo sourcetype=capgo:audit
| eval action=lower(action), actor=coalesce(user_id, actor_id)
| transaction actor maxspan=24h
| search (
    action="organization.role_binding.delete" OR
    action="role_binding.deleted" OR
    action="org_role_binding.remove"
  ) AND (
    action="channel.update" OR
    action="channel.version.publish" OR
    action="channel.override.set" OR
    action="ota.version.change"
  )
| table _time actor organization_id channel_id action src_ip
| sort - _time

Wazuh OSSEC Rule

<group name="capgo,cve-2026-88860,">
  <rule id="100860" level="0">
    <decoded_as>json</decoded_as>
    <field name="action">role_binding\.delete|role-binding\.remove</field>
    <description>Capgo: organization role binding deleted</description>
  </rule>

  <rule id="100861" level="12" frequency="2" timeframe="86400">
    <if_matched_sid>100860</if_matched_sid>
    <field name="action">channel\.update|channel\.version\.publish|channel\.override\.set|ota\.version\.change</field>
    <same_field>actor_id</same_field>
    <description>CVE-2026-88860: channel modification after role binding deletion by same actor - possible stale override abuse</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, advisory, or patched version has been identified from any tracked source. Affected version ranges are undisclosed. The following guidance is defensive and does not depend on a vendor patch.

1. Immediate mitigations

• On any user deprovisioning, explicitly delete or nullify all channel permission overrides before or in the same operation as removing the organization role binding. Treat override cleanup as a mandatory step of the offboarding runbook.
• Audit the current state of the override store for orphaned entries: enumerate overrides whose owning user has zero remaining organization role bindings, and remove them.
• Invalidate all active sessions and rotate credentials for any user whose last role binding was deleted, so that session persistence cannot combine with stale overrides.
• Minimize standing channel overrides. Where possible, model channel permissions exclusively through organization roles so that a single deletion cascades correctly.
• Restrict who can modify production channels and add approval gates / break-glass review for production OTA version changes.

2. Patch / upgrade steps

• Monitor the Capgo project's official release channels and security advisories for a fix. There is no published patch at the time of writing; do not assume any version is fixed.
• Until a patch is confirmed, apply the compensating controls above and re-verify them after each upgrade.
• When a fix is released, validate that override cleanup occurs on last-role-binding deletion before re-enabling any relaxed controls.

3. Long-term hardening

• Refactor authorization to recompute effective permissions from current role bindings at evaluation time, rather than trusting a persisted override store that can drift out of sync.
• Implement cascading deletes / referential integrity between role bindings and override records at the data layer.
• Add continuous compliance checks that flag any actor with channel permissions but no active organization role binding.
• Log and alert on all channel-scoped privileged actions (see Detection Guidance) as a durable detective control independent of the fix.

References

1. NVD — CVE-2026-88860: https://nvd.nist.gov/vuln/detail/CVE-2026-88860
2. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
3. MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. Capgo project documentation and release notes: https://capgo.app
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing are associated with this CVE. EPSS has not yet been scored by FIRST.org. No named threat actor campaigns are known. All exploitation content in this report is inferred from the CWE-863 vulnerability class and the NVD description and does not represent observed in-the-wild activity.