Threats tagged 'ghsa-39p6-jffm-wc33'

Capgo CLI versions up to 7.98.2 have an improper privilege management vulnerability in the Android onboarding flow. The CLI assigns a Google Play service account overly broad permissions (CAN_MANAGE_DRAFT_APPS_GLOBAL) at the developer account level instead of restricting it to a single app with release-only permissions. This discrepancy allows anyone with access to the service account key to manage draft apps across the entire Google Play developer account. No patch was available at the time of publication.