{"id":20641,"date":"2026-09-11T00:32:12","date_gmt":"2026-09-10T16:32:12","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-88861"},"modified":"2026-09-11T00:32:12","modified_gmt":"2026-09-10T16:32:12","slug":"cve-2026-88861","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-88861","title":{"rendered":"CVE-2026-88861 [HIGH] &#8211; Capgo (Cap-go\/capgo.app) contains an authentication bypass affecting all versions (no patc"},"content":{"rendered":"<p>Capgo (Cap-go\/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase\/functions\/_backend\/utils\/hono_middleware.ts) accepts the JWT without validating its assurance level, and the direct RBAC path (checkPermission()\/checkPermissionPg() in supabase\/functions\/_backend\/utils\/rbac.ts calling public.rbac_check_permission_direct()) authorizes by user ID without passing or checking the session aal, unlike the public.verify_mfa() control which correctly requires aal2. An attacker who knows only the victim&#8217;s password can therefore authenticate, mint a persistent app-scoped app_admin API key that remains valid after the aal1 session is logged out, and perform privileged operations such as modifying production OTA channel configurations (validated by changing a public production channel from bundle 1.0.0 to 1.0.1), defeating the protection provided by MFA.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Capgo (Cap-go\/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20641","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}