Capgo CVE-2026-88861

Exploitation requires: (1) the attacker must know the victim's valid Capgo account password - aal1 authentication with the password alone is sufficient to reach the vulnerable code path; (2) the target account must have at least one verified MFA factor registered, because accounts without any MFA factor have no aal2 boundary to bypass regardless; (3) the compromised account must hold RBAC permissions sufficient to create API keys or modify OTA channels (e.g., the app_admin role). Exploitation is limited to the direct RBAC code path (checkPermissionPg()/rbac_check_permission_direct()); the separate verify_mfa() control path correctly enforces aal2 and is not bypassed. No victim interaction is required after the attacker obtains the password, and the attack is fully remote over the network.

The CVSS 4.0 score of 8.7 reflects a serious network-exploitable vulnerability. However, two metric choices in the provided vector warrant scrutiny. First, PR:N understates the prerequisite: exploitation requires knowledge of the victim's account password, which in CVSS 3.1 terms is PR:L - the attacker possesses partial credentials (aal1) and exploits the missing aal2 enforcement. Second, the vector records VI:N and SI:N (no integrity impact) despite the advisory's explicit PoC demonstrating modification of production OTA channel configurations, a clear integrity violation with potential downstream impact on every mobile device polling that channel. Real-world risk is elevated for Capgo customers who treat MFA as a security boundary for OTA release management: a compromised production channel could push attacker-controlled app updates to potentially large end-user populations. The persistent API key vector is particularly concerning because it survives session termination, extending the attacker's foothold beyond the initial aal1 session. No KEV listing and no standalone exploit tool are present in the input data, but the advisory provides sufficient technical detail for skilled exploitation. With no patch available, the risk is ongoing for all deployed instances.

An attacker who has obtained a Capgo account password through phishing or credential stuffing authenticates to the Supabase backend, receives an aal1 JWT, and - without completing any MFA challenge - calls the privileged RBAC-protected endpoint that routes through checkPermissionPg(), successfully minting a persistent app_admin API key. Using this long-lived key, the attacker modifies a production OTA channel to point to an attacker-controlled bundle, causing mobile devices polling that channel to receive a malicious application update while the original account holder remains unaware.