EUVD-2026-87715
GHSA-39p6-jffm-wc33
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because the attacker must possess the high-privileged service account key; network vector and low complexity via the Publisher API; C:N with only limited integrity/availability impact confined to draft apps.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.
AnalysisAI
Capgo CLI's Android onboarding flow silently grants the Google Play service account it generates the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL, so anyone who obtains the resulting PLAY_CONFIG_JSON key can create, edit, and delete draft apps across the entire Google Play developer account rather than only the single confirmed package the UI claims was shared. The issue affects the npm package @capgo/cli through 7.98.2 and is present in default onboarding, but exploitation is entirely conditional on key exposure - a leaked key in a public repository, CI log, or compromised secrets store - and impact is confined to draft apps with no effect on already-published releases and no confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a victim who onboarded an Android app to Capgo CLI (≤7.98.2) via the Google OAuth flow, which provisions a Play Console service account carrying the account-wide CAN_MANAGE_DRAFT_APPS_GLOBAL permission, and (2) the attacker obtaining the generated service account key file (PLAY_CONFIG_JSON) - e.g., leaked to a public repo, CI logs, or a compromised secrets store. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-severity design flaw, not a high-urgency issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so the immediate action is credential hygiene rather than upgrade: rotate and revoke the service account key generated by the Capgo CLI OAuth onboarding flow, remove any PLAY_CONFIG_JSON from source repositories, CI variables, build logs, and shared secret stores, and enable secret scanning to catch future exposure - rotation temporarily breaks automated Play Store uploads until the new key is redistributed to your pipelines. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today