Description (CNA)
Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cap-go / capgo.app | affected 0 through * |
CWE
CWE-862
References
- https://github.com/Cap-go/capgo.app/security/advisories/GHSA-626c-p6fq-3whq
- https://www.vulncheck.com/advisories/cap-go-capgo-app-authorization-bypass-via-channel-permission-overrides
ADP enrichment
No English description supplied.