CVE-2026-100617

Summary

The flaw allows authenticated app/org admins to grant channel permissions to non-member users, enabling attackers with admin privileges to bypass organization membership checks and grant unauthorized access.

Exploitability

Exploitation is relatively straightforward for attackers with admin privileges, as they can insert override rows with arbitrary external user UUIDs.

Blast radius

If exploited, this flaw could lead to unauthorized access and control over sensitive channels, potentially compromising the integrity and confidentiality of the application and its data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of Cap-go capgo.app, specifically version 2.590 or later, as published by the vendor.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.