CVE-2026-100620 Details
Description
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.
A vulnerability exists in Capgo CLI (npm package @capgo/cli) in versions through 7.98.2, where the Android onboarding process via Google OAuth grants an over-permissioned service account. The CLI invites the generated Google Play service account with the account-wide Play Console permission 'CAN_MANAGE_DRAFT_APPS_GLOBAL', allowing access to create, edit, and delete draft apps across the entire Google Play developer account. This permission is granted despite the user-facing indication that the service account is limited to a single app with release-only permissions. Consequently, anyone with the generated service account key can manipulate draft apps across all applications in the developer account, rather than being restricted to a specific package. No patched version was available at the time of publication.
Users are advised to remove 'CAN_MANAGE_DRAFT_APPS_GLOBAL' from the service account permissions and rely on per-app grants for the selected package. If a developer-level permission is required for the service account to appear in the Users & permissions list, it should be the narrowest permission that satisfies the API requirements.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Oct 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-wf94-285x-4cgj | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-wf94-285x-4cgj | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/capgo-cli-through-7.98.2-excessive-permissions-via-overpermissioned-play-console-service-account | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo CLI | <= 7.98.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 5, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |