CVE-2026-88860
Capgo, a platform for over-the-air updates, has a flaw that lets users keep channel permissions even after their main organization role is removed. This can let attackers perform actions they should no longer be able to, such as changing production firmware. The issue is critical because it bypasses normal access controls.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Capgo platform users, especially those who manage channel permissions and OTA updates. The specific affected versions are not listed.
Real-world impact
An attacker who had their main organization role removed could still modify channel permissions and push unauthorized updates to devices, potentially compromising device security.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability allows attackers to gain high confidentiality, integrity, and availability impact by bypassing role‑based access controls. It is easy to exploit over the network with no authentication, and it can lead to serious damage.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources