CVE-2026-88860— Capgo Authorization Bypass via Stale Channel Permission Overrides
Quick assessment
Affected
Cap-go capgo.app
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当用户最后一个组织角色绑定被删除时，Capgo 未能清理通道权限覆盖项，导致过期的覆盖项仍处于激活状态。攻击者在基础 RBAC 访问权限被撤销后，仍可保留特定通道的权限，从而执行未经授权的操作，例如更改生产环境的 OTA 版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Capgo Authorization Bypass via Stale Channel Permission Overrides
Source: CVE Program / CVE List V5
Vulnerability Description
Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-88860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88860
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-88860 (2)
Same Patch Batch · Cap-go · 2026-09-10 · 5 CVEs total
| CVE-2026-88864 | 9.1 CRITICAL | Capgo SSO Provider Authentication Bypass via PostgREST Direct Write |
| CVE-2026-88862 | 8.8 HIGH | Capgo API Key Manager Authentication Bypass via x-limited-key-id |
| CVE-2026-88861 | 8.3 HIGH | Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization |
| CVE-2026-88863 | 8.1 HIGH | capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org |
IV. Related Vulnerabilities
Same product: capgo.app
-
CVE-2026-88864
Capgo SSO Provider Authentication Bypass via PostgREST Direc -
CVE-2026-88863
capgo.app through 12.207.1 Privilege Escalation via invite_n -
CVE-2026-88862
Capgo API Key Manager Authentication Bypass via x-limited-ke -
CVE-2026-88861
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Same vendor: Cap-go
-
CVE-2026-88864
Capgo SSO Provider Authentication Bypass via PostgREST Direc -
CVE-2026-88863
capgo.app through 12.207.1 Privilege Escalation via invite_n -
CVE-2026-88862
Capgo API Key Manager Authentication Bypass via x-limited-ke -
CVE-2026-88861
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization -
CVE-2026-56339
Capgo - Unauthenticated Organization Existence Enumeration v
Same weakness: CWE-863
-
CVE-2026-88044
rclone: RC per-server auth-proxy bypass -
CVE-2026-88939
knowns through 0.33.0 Authorization Bypass via project.set B -
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still -
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or ro -
CVE-2026-88894
Snipe-IT before 8.7.2 Authorization Bypass via Predefined Ki
V. Comments for CVE-2026-88860
No comments yet