CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated app or organization administrators to improperly grant channel permissions to external users by inserting arbitrary UUIDs into channel_permission_overrides, bypassing organizational membership checks. This could lead to unauthorized access to sensitive channel functionalities, posing a significant risk to data integrity and confidentiality. Organizations utilizing the affected Cap-go application should prioritize remediation to prevent potential exploitation by malicious insiders or compromised admin accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.