Capgo CVE-2026-100626

Requires an authenticated Capgo account (PR:L) - any valid tenant user, no admin privileges needed. The attacker abuses the PUT /app/:appId endpoint's acceptance of attacker-controlled icon storage paths within the private images bucket; the server then issues service-role-signed URLs (7-day validity) that ignore per-tenant authorization boundaries. Exploitation is limited by the need for a valid account and by the low sensitivity of the exposed objects (avatars, organization logos, app icons only); there is no write, modification, or availability impact and no privilege escalation.

This is a genuine but low-to-moderate priority issue, well characterized by its CVSS 4.0 vector (5.3, MEDIUM): network vector (AV:N), low complexity (AC:L), but requiring privileges (PR:L, i.e. an authenticated Capgo account) and delivering only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N) and no scope/subsequent-system change (SC:N). No EPSS score, CISA KEV entry, or public POC was provided, so there is no evidence of active or automated exploitation - the signal set points to a targeted, manual IDOR rather than a mass-exploitable flaw. The real-world impact ceiling is low because the cross-tenant objects exposed are images (user avatars, organization logos, app icons), not credentials or PII-heavy records; this justifies the C:L rating rather than C:H. Note the input tag 'Authentication Bypass' overstates the issue: CWE-639 and the description describe a post-authentication authorization/IDOR defect (attacker must already be logged in, PR:L), not a bypass of authentication itself. Overall: a real, confirmed authorization bug worth patching, but not an emergency absent broader data.

An attacker registers or already holds a legitimate authenticated Capgo account, then calls PUT /app/:appId supplying an attacker-chosen storage path inside the private images bucket. The backend returns a service-role-signed URL valid for 7 days, which the attacker uses to download another tenant's avatars, organization logos, or app icons without authorization. No public exploit code was identified at time of analysis; low attack complexity means the request is straightforward to craft once authenticated.