Capgo EUVD-2026-87721

Exploitation requires a valid Capgo API key of type 'all' or 'write' bound to a role carrying app-level channel.promote_bundle (granted by default to the app_developer and app_uploader roles) - so the actor is an already-privileged deployer, not an anonymous outsider. The flaw only produces impact when an administrator has actually configured an explicit per-channel deny (or allow) override on the target channel_id; without such an override there is nothing to bypass. The attacker must also know or supply the target channel_id of a channel they were explicitly denied. No user interaction is needed and the endpoint is network-reachable (PUT /bundle).

The only quantitative signal provided is the vendor/VulnCheck CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H). No EPSS probability, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' This is a genuine authorization flaw (CWE-639 IDOR), not a high-CVSS-but-empty issue, but its real-world priority is moderated by an important prerequisite the raw score understates: the attacker must ALREADY hold an app-level 'channel.promote_bundle' permission (default on the app_developer and app_uploader roles) via a valid 'all' or 'write' API key. The vulnerability does not grant a new capability to an outsider - it lets an already-privileged deployer bypass a narrower per-channel DENY override. I note a labeling conflict: the input Tags call this 'Authentication Bypass,' but the mechanism (a privileged principal circumventing a per-channel authorization override) is authorization/access-control, consistent with the assigned CWE-639. There is no independent evidence (EPSS/KEV/POC) to elevate this beyond a targeted, low-likelihood risk against Capgo self-hosters and the Capgo cloud backend.

An attacker (or a compromised low-trust CI token) holding a Capgo 'write' or 'all' API key with the default app_developer/app_uploader role sends a PUT /bundle request naming a channel_id for which an administrator has configured an explicit per-channel deny override. Because the promotion path never forwards channel_id into the RBAC check, the deny override is silently skipped and the attacker updates public.channels.version, delivering an OTA bundle to that channel's end-user devices. No public proof-of-concept is referenced in the available data.