https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:47:37.398410+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-379578 EUVD-2026-379578 2026-10-07T14:47:37.444254+00:00 EUVD-2026-379578 https://cve.radiocsirt.org/vuln/fkie_cve-2026-88860 fkie_cve-2026-88860 2026-10-07T14:47:37.444290+00:00

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

 https://cve.radiocsirt.org/vuln/ghsa-5rmr-6c73-3q3m GHSA-5rmr-6c73-3q3m 2026-10-07T14:47:37.444324+00:00

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.