The vulnerability in Cap-go's backend arises from an incorrect authorization check in the PUT /bundle endpoint. This endpoint calls setChannel, which authorizes using checkPermission with an app-level scope but omits the channel_id parameter. Because the channel_id is passed as SQL NULL, the per-channel allow/deny overrides are never evaluated, effectively bypassing channel-specific deny permissions. As a result, users with app-level channel.promote_bundle permission (typically app_developer and app_uploader roles) can promote bundles to channels even if explicit per-channel deny overrides exist. The target channel validation occurs only after authorization, enabling unauthorized updates to public.channels.version. The vulnerability is confirmed on the main branch at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely affects earlier versions. No patch or remediation is currently known.

An attacker or user with app-level channel.promote_bundle permission can bypass per-channel deny overrides and promote bundles to channels they should not have access to. This unauthorized action can lead to unauthorized updates to channel versions, potentially impacting channel content integrity and access control enforcement within the Cap-go platform. The vulnerability allows privilege escalation within the scope of bundle promotion to channels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict app-level channel.promote_bundle permissions to trusted roles only and monitor for unauthorized bundle promotion activities. Avoid granting broad app-level permissions that include channel.promote_bundle to untrusted users.