The vulnerability in Capgo's backend (versions ≤ 12.261.0) arises because the apikey_manager role's ability to assign roles to new API keys is insufficiently restricted. The system only enforces a deny-list of roles and a priority-rank check but does not verify that the caller holds the permissions of the assigned role. Since deploy roles like app_developer and app_uploader are omitted from the deny-list and have lower priority ranks than apikey_manager, an attacker with apikey_manager permissions can create API keys with these deploy roles. This allows unauthorized users to push arbitrary OTA JavaScript updates to all end users of the organization's apps.

An authenticated user with the apikey_manager role can escalate privileges by creating API keys bound to deploy roles that they should not have access to. This enables them to push arbitrary over-the-air JavaScript updates to all users of the organization's applications, potentially leading to unauthorized code execution and compromise of app integrity.

As of the advisory publication, no patched version is available. Organizations should monitor vendor advisories for updates. Until a fix is released, restrict apikey_manager role assignments and limit access to users with this role to trusted personnel only.