Cap-go's capgo.app fails to properly clean up channel permission overrides when a user's final organization role binding is deleted. This flaw leaves stale permission overrides active, enabling attackers to maintain channel-specific permissions despite revocation of their base role-based access control (RBAC) rights. The vulnerability allows unauthorized actions, including modifying production over-the-air (OTA) versions. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or remediation guidance is currently available, and the product is not a cloud service.

Attackers can retain channel-specific permissions after their base RBAC access is revoked, allowing unauthorized actions such as changing production OTA versions. This can lead to unauthorized modification of critical production configurations, potentially compromising system integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should carefully monitor and audit channel permission overrides and consider manual cleanup of stale permissions when user role bindings are removed.