CVE-2026-100615— Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
Quick assessment
Affected
Cap-go capgo.app
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Cap-go capgo.app 版本 12.267.1 之前，系统在密钥轮换（rotation）过程中未能正确验证目标 API 密钥的权限级别。该漏洞允许具有 角色的用户轮换拥有更高权限的同属一组织的管理员密钥（org_super_admin 类型的同级密钥），并获取其明文凭证。 具备 角色的攻击者可以枚举同一所有者下的其他 API 密钥，通过 PUT 端点轮换权限更高的同级密钥，从而获取替换后的明文密钥，并利用该密钥冒充权限更高的主体进行身份验证。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100615
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
Source: CVE Program / CVE List V5
Vulnerability Description
Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as the higher-privileged principal.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100615
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100615
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100615 (1)
Other References for CVE-2026-100615 (1)
Same Patch Batch · Cap-go · 2026-09-26 · 19 CVEs total
| CVE-2026-100619 | 8.8 HIGH | Capgo OTA Manifest Poisoning via app_versions.manifest Bypass |
| CVE-2026-100614 | 8.8 HIGH | Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker |
| CVE-2026-100623 | 8.8 HIGH | Capgo Authentication Bypass via Direct PostgREST org_users Table Write |
| CVE-2026-100617 | 8.8 HIGH | Cap-go capgo.app Authorization Bypass via channel_permission_overrides |
| CVE-2026-100618 | 8.5 HIGH | Capgo App Icon Update Privilege Escalation via Service-Role Worker |
| CVE-2026-100627 | 8.1 HIGH | Capgo bundle promotion API channel RBAC deny override bypass |
| CVE-2026-100622 | 7.5 HIGH | capgo.app through 12.129.0 Cache Restoration of Deleted Bundles |
| CVE-2026-100612 | 7.2 HIGH | Capgo SSO Provider ID Authentication Bypass via Incomplete Migration |
| CVE-2026-100625 | 7.1 HIGH | Capgo Build Upload Proxy Authorization Bypass via TUS Resource |
| CVE-2026-100611 | 6.5 MEDIUM | Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list |
| CVE-2026-100629 | 5.5 MEDIUM | Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH |
| CVE-2026-100616 | 5.5 MEDIUM | capgo.app Authentication Bypass via PostgREST customer_id Mutation |
| CVE-2026-100624 | 5.4 MEDIUM | Capgo.app before 12.264.5 Upload Expiry Bypass via build upload |
| CVE-2026-100613 | 5.3 MEDIUM | capgo.app Authorization Bypass via Stale Channel Permission Overrides |
| CVE-2026-100626 | 4.3 MEDIUM | capgo through 12.128.2 IDOR via PUT /app icon endpoint |
| CVE-2026-100621 | 4.3 MEDIUM | capgo.app Content-Lock Bypass via r2-direct Bundle Mutation |
| CVE-2026-100628 | 4.3 MEDIUM | capgo.app before 12.128.12 Authentication Bypass via apikey |
| CVE-2026-100620 | 3.8 LOW | Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service A |
IV. Related Vulnerabilities
Same product: capgo.app
-
CVE-2026-100626
capgo through 12.128.2 IDOR via PUT /app icon endpoint -
CVE-2026-100629
Capgo backend before 12.127.5 Privilege Escalation via role_ -
CVE-2026-100628
capgo.app before 12.128.12 Authentication Bypass via apikey -
CVE-2026-100627
Capgo bundle promotion API channel RBAC deny override bypass -
CVE-2026-100625
Capgo Build Upload Proxy Authorization Bypass via TUS Resour
Same vendor: Cap-go
-
CVE-2026-100626
capgo through 12.128.2 IDOR via PUT /app icon endpoint -
CVE-2026-100629
Capgo backend before 12.127.5 Privilege Escalation via role_ -
CVE-2026-100628
capgo.app before 12.128.12 Authentication Bypass via apikey -
CVE-2026-100627
Capgo bundle promotion API channel RBAC deny override bypass -
CVE-2026-100625
Capgo Build Upload Proxy Authorization Bypass via TUS Resour
Same weakness: CWE-269
-
CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass -
CVE-2026-77203
Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Esca -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100620
Capgo CLI through 7.98.2 Excessive Permissions via Overpermi -
CVE-2026-100611
Capgo apikey_manager Role Privilege Escalation via Incomplet
V. Comments for CVE-2026-100615
No comments yet