Capgo CVE-2026-100619

Attacker must possess an app-scoped upload/write/all API key with upload+ rights, or be an authenticated user with write+ rights on the target app. The target version must have storage_provider set to 'r2-direct', which is the specific configuration excluded from the bundle content-lock check that otherwise protects manifest integrity. Exploitation also requires that a channel points to (or can be made to point to) the crafted version so the poisoned manifest is served via /updates. Limiting factors: the requirement for pre-existing write-capable credentials (no unauthenticated path) and the r2-direct storage precondition - versions using other storage providers are not exploitable through this bypass.

This is a genuine high-priority integrity flaw rather than a CVSS-inflated one, though the vendor score understates the true blast radius. The vendor CVSS 4.0 vector (8.7, AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) correctly captures network reach and low attacker complexity, but scores subsequent-system impact as none (SC:N/SI:N/SA:N) despite the description stating the poisoned manifest is served to end-user devices via the /updates endpoint - that is a scope change into a downstream system, so the real severity is arguably higher than 8.7, not lower. Exploitation is NOT unauthenticated: the CVSS PR:L and the description both require either an app-scoped upload/write/all API key or an authenticated user with write+ rights on the app, so this is an authenticated privilege-abuse/confused-deputy issue (CWE-266), not the 'Authentication Bypass' the tag implies. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation - priority rests on the severity of the outcome (arbitrary OTA payload delivery to app end users through a trusted service-role worker) and the fact that all versions are affected with no patch available at publication. The one meaningful limiting factor the vendor vector omits is the storage_provider='r2-direct' precondition, which narrows exploitable versions.

An attacker holding a legitimate app-scoped upload/write API key (or an authenticated collaborator with write+ rights) updates the app_versions.manifest field on a version configured with storage_provider 'r2-direct', which escapes the bundle content-lock check. The on_version_update async worker trusts the attacker-supplied manifest and, using the privileged service-role Supabase client, writes attacker-controlled file_name, file_hash, and s3_path into the RLS-protected public.manifest table; once a channel points at that version, every device polling /updates receives the poisoned download_url. No public exploit code was identified at the time of analysis.