External risk intelligence

Capgo Stale Channel Permissions Authorization Bypass.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-88860

Capgo is an over-the-air (OTA) update service typically deployed as a web-based platform or API to manage application versions and deployments. As a centralized management service for application updates, the platform interface and its associated permission/channel management features are commonly exposed as internet-facing web services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a vulnerability in Capgo, a system for managing application updates, where permissions may not be properly revoked when a user loses access. This could allow unauthorized individuals to retain the ability to change critical settings, such as production update versions, even after their primary access has been removed.

Stale permissions can let users change update versions.
Leadership should remember Capgo's role in managing app updates.
Confirm relevance and exposure of Capgo to your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting the Capgo platform, which manages application updates. If an attacker's access to an organization within Capgo is removed, but specific channel permission overrides are not properly cleaned up, they could retain unauthorized permissions. This could allow them to perform actions they should no longer have access to, such as altering production over-the-air update versions.

Entry condition: Attacker had prior organizational access.
Trigger point: Deleting the last organization role binding.
Resulting risk: Unauthorized actions on production updates.

Live Threat

Current exploitation, exposure, and threat context

When a user's last role binding is deleted, Capgo may leave stale channel permission overrides active. This could allow an attacker to retain channel-specific permissions even after their base access has been revoked, potentially enabling them to perform unauthorized actions.

Stale channel permissions could be exploited.
Permissions may persist after role removal.
Unauthorized actions on production OTA versions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Capgo platform's handling of channel permission overrides presents a risk to system integrity, specifically allowing unauthorized modifications to production over-the-air (OTA) versions. Technical leaders and security teams should prioritize identifying all instances of Capgo, verifying their exposure and criticality, and then engaging the relevant platform or application owners to plan remediation. This issue requires prompt attention due to the potential for attackers to retain elevated channel-specific permissions even after their primary access has been revoked.

Identify platform owners and affected systems.
Verify Capgo instances and exposure.
Plan remediation with platform owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Capgo and how is it used?

Capgo is an over-the-air (OTA) update service. Organizations use it as a centralized platform or API to manage the deployment and versioning of application updates. By acting as a control plane for what code runs on end-user devices, it allows administrators to push new software versions or configuration changes directly to apps. Because it manages these deployments, it requires granular permission controls to ensure only authorized personnel can modify production update channels.

What does CWE-863 mean for CVE-2026-88860?

CWE-863 refers to an Incorrect Authorization weakness. In the context of this CVE, it means the software fails to properly verify or revoke a user's rights when their status changes. Specifically, while the system correctly removes a user's primary organizational role, it neglects to clear secondary, channel-specific permission overrides. This results in an authorization bypass where the user retains active, elevated privileges that should have been terminated along with their main account access.

What triggers this authorization bypass?

The vulnerability is triggered when a user's last organization role binding is deleted within Capgo. The system fails to perform a cleanup operation on specific channel permission overrides that were associated with that user. It is important to note that this bug is not triggered by standard role changes or additions; the persistence of unauthorized access is strictly linked to the failure to remove those specific channel-level overrides during the deletion of the final primary role binding.

Is my Capgo instance at risk?

According to Halo Surface Signal, Capgo is typically deployed as a web-based platform or API, meaning it is often configured as an internet-facing service. Because it manages sensitive application deployments, any instance accessible over the network could be a target. You should prioritize assessment if your Capgo installation is reachable from the internet, as this increases the likelihood that an attacker could exploit these stale permissions to manipulate your production OTA update versions.

How should I respond to CVE-2026-88860?

Start by identifying all instances of Capgo in your environment and determining who owns or manages the platform. Since this issue involves authorization logic, verify if your current user lifecycle management processes involve frequent role revocations that might trigger these stale overrides. Engage your application owners to plan remediation steps and ensure that permission cleanup is enforced. Promptly auditing existing channel permissions is a critical first step to prevent unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.