CVE-2026-100627 Capgo bundle promotion API channel RBAC deny override bypass

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

CVE-2026-100627 Capgo bundle promotion API channel RBAC deny override bypass

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

EUVD-2026-87721

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

CVE-2026-100627 Capgo bundle promotion API channel RBAC deny override bypass

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

PT-2026-99298

Name of the Vulnerable Software and Affected Versions Capgo Cap-go/capgo.app server backend affected versions not specified Description An incorrect authorization flaw exists in the API-key bundle promotion path. The 'PUT /bundle' endpoint, accessible to all and write API keys, utilizes the...