medium6.3
CVE-2026-88860
Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active.
Impact
Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.