vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-100620

Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

LOW
3.8
CVSS Score
Published: September 26, 2026 at 01:22 PM UTC
Updated: October 5, 2026 at 04:17 PM UTC
1 product affected across 1 vendorCapgo CLI

Using cli by capgo?

Get instant alerts when new vulnerabilities affect cli - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW3.8
Exploit prediction
EPSS 0.3%
SSVC
PoC

Description

Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as developerAccountPermissions in the Android Publisher API User create request), even though the user-facing flow states the service account is invited into a single confirmed app with release-only permissions. As a result, anyone who obtains the generated service account key (PLAY_CONFIG_JSON) can create, edit, and delete draft apps across the entire Google Play developer account rather than being limited to the selected package. No patched version was available at the time of publication.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Capgo CLI· Capgonpm
60%
v ≤ 7.98.2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

Vendor Advisory
Source: cverecord
https://github.com/Cap-go/capgo.app/security/advisories/GHSA-wf94-285x-4cgj
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/capgo-cli-through-7.98.2-excessive-permissions-via-overpermissioned-play-console-service-account

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

3.8LOWVulnCheck
Attack Vector
NETWORK
Complexity
LOW
Privileges
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-269

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card