EUVD-2026-38093
GHSA-7hf5-4jq6-894f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv API key over network, no UI; scope changes because leaked HMAC secrets compromise downstream receivers, high confidentiality, no direct integrity/availability on Capgo.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhook_deliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.
AnalysisAI
Cross-tenant data exposure in Capgo before 12.128.2 lets an authenticated org-scoped read API key reach other tenants' PostgREST endpoints and pull HMAC webhook signing secrets plus delivery logs. Disclosed by VulnCheck with a vendor GitHub Security Advisory (GHSA-hj3h-v877-g5rx); no public exploit identified at time of analysis, and the secrets retrieved enable subsequent forgery of authentic-looking webhook events against victim organizations.
Technical ContextAI
Capgo is a self-hosted/SaaS over-the-air update platform for Capacitor apps that exposes its Supabase/PostgREST data layer through token-scoped REST endpoints. The flaw is a CWE-200 information exposure rooted in missing or misconfigured row-level security (RLS) policies on the webhooks and webhook_deliveries tables: org-scoped read keys, which should be constrained to a single tenant_id, are accepted by PostgREST for rows belonging to other tenants. Because webhook records carry the HMAC signing secret used to authenticate outbound event callbacks, a read primitive on this table converts directly into a write/forgery capability against any downstream consumer that trusts the signed payload.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later per GHSA-hj3h-v877-g5rx. Because the leaked material is long-lived signing material, patching alone is insufficient: rotate every webhook HMAC secret after upgrade and audit webhook_deliveries access logs for cross-tenant queries from org-scoped read keys prior to the fix. Operators who cannot upgrade immediately should revoke or scope down outstanding read API keys, tighten the PostgREST RLS policies on the webhooks and webhook_deliveries tables to enforce tenant_id = auth.jwt()->>'org_id' (accepting that any legitimate reporting integrations relying on broad reads will break until reconfigured), and require receivers to add IP allowlisting or mTLS to defend against forged webhooks until rotation completes.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today