Authorization Bypass in API Key Bundle Promotion

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) and omits the request's channel_id. Because the omitted scope field is passed to rbac_check_permission_direct as SQL NULL, and channel-scope override evaluation is gated on p_channel_id IS NOT NULL, per-channel allow/deny overrides are never evaluated. A principal holding app-level channel.promote_bundle (granted by default to the app_developer and app_uploader roles) can therefore promote a bundle to a channel for which an explicit per-channel deny override exists, updating public.channels.version for the supplied channel_id; the target channel is only validated after authorization. The issue is confirmed on main at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and li

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-100627 is an authorization flaw in Capgo's Supabase backend affecting the PUT /bundle endpoint. The vulnerability stems from an incomplete permission check that omits the channel_id parameter when validating if a user can promote bundles. This missing scope causes the authorization system to evaluate NULL values in role-based access control (RBAC) queries, effectively bypassing channel-level restrictions. Any user with 'all' or 'write' API keys can exploit this to promote bundles across unauthorized channels, leading to unauthorized application updates and potential supply chain compromise. This affects all Capgo users relying on API key-based access controls for bundle management.

Casky's 283 mapped security skills detect this vulnerability pattern by analyzing the MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners would observe findings related to improper authorization logic (CWE-639), specifically: API requests with missing or NULL authorization scope parameters, inconsistent permission validation between endpoint entry points and downstream authorization checks, and API keys gaining cross-channel access they should not possess. Using Claude's extended reasoning, Casky correlates these indicators with typical bypass patterns—such as parameter omission, NULL handling in RBAC systems, and authorization checks that fail open rather than closed—enabling security teams to identify similar authorization flaws in custom API implementations before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100627.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-100627

Casky has 283 skills that investigate the attack patterns behind CVE-2026-100627. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn