EUVD-2026-38102
GHSA-cr4w-2ppq-m3wq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain leaked app-limited API key
-
DeliverySend POST /functions/v1/apikey with empty limits
-
ExploitReceive unrestricted org-wide key
-
ExecutionEnumerate apps and protected endpoints
-
ImpactExfiltrate or tamper with OTA bundles
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a running Capgo deployment at a version below 12.128.2, and (2) possession of any valid app-limited API key for the target organization to authenticate the POST /functions/v1/apikey request. No user interaction, no admin role, no non-default configuration, and no platform-specific conditions are needed - the vulnerable endpoint is exposed in default installs. The principal limiting factor is the need for that initial scoped key; fully unauthenticated callers cannot trigger the flaw, which is consistent with the CVSS PR:L metric. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting a network-reachable, low-complexity flaw that needs only a low-privilege (app-limited) API key to produce full-confidentiality, integrity, and availability impact within an organization. KEV status is not listed and no EPSS, SSVC, or public POC data were provided in the input, so widespread opportunistic exploitation is not yet evidenced; however, because the prerequisite is merely possession of any app-limited key (which are routinely embedded in mobile clients or CI pipelines), the practical barrier is low. This is a real priority for any Capgo-hosted or self-hosted deployment because key leakage is common and the escalation path is a single API call rather than a multi-stage chain. |
| Exploit ScenarioDerived | An attacker who obtains an app-limited Capgo API key - for example by extracting it from a decompiled mobile binary, CI log, or a leaked .env file - issues a POST to /functions/v1/apikey with an empty limits payload. The server returns a new, unrestricted org-wide key, which the attacker then uses to enumerate all app listings, pull update bundles, and tamper with OTA deployments across the victim organization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 20, 2026
Privilege escalation in Capgo before 12.128.2 allows holders of app-limited API keys to mint new unrestricted keys via the POST /functions/v1/apikey endpoint by submitting empty limit fields. The flaw effectively bypasses the API key scoping model, granting org-wide access to app listings and other protected resources from any compromised low-privilege key. No public exploit identified at time of analysis, but a vendor advisory (GHSA-2ff8-7h96-hwfp) and a VulnCheck writeup confirm the issue.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, per the GitHub Security Advisory GHSA-2ff8-7h96-hwfp (https://github.com/Cap-go/capgo/security/advisories/GHSA-2ff8-7h96-hwfp). Operators who cannot immediately update should rotate and revoke all existing app-limited API keys (since any could have been used to mint unrestricted peers), audit the apikeys table for keys with empty or null limit fields created prior to the upgrade, and restrict ingress to /functions/v1/apikey behind an authenticated proxy that rejects requests carrying app-limited tokens - recognizing this will break legitimate self-service key creation flows for scoped clients until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is an open-source live-update and over-the-air (OTA) deployment platform for Capacitor mobile apps, exposing a Supabase-backed serverless API under /functions/v1/. The vulnerable endpoint, POST /functions/v1/apikey, generates new API keys but fails to enforce that a child key's limits remain a subset of the requesting key's limits. The root cause maps to CWE-269 (Improper Privilege Management): the server treats an empty limits object as 'no restrictions' rather than rejecting or inheriting from the caller, so a scoped (app-limited) key is allowed to author an unscoped peer. The affected CPE is cpe:2.3:a:capgo:capgo, covering all releases prior to 12.128.2.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network endpoint, no special conditions, requires a low-privilege app-limited key (PR:L), no user interaction; scope changes from scoped key to org-wide resources (S:C) with full CIA impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key can create an unrestricted key with org-wide access to resources like app listings and other protected endpoints.
Executive ViewAI
Capgo before version 12.128.2 contains a privilege escalation vulnerability in its API key management system that allows holders of low-privilege API keys to create unrestricted organization-wide keys, bypassing intended access controls. Any compromised or misused app-level API key could grant attackers full organizational access to app listings and protected resources. Organizations using Capgo must immediately audit API key usage and implement emergency controls to prevent unauthorized access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately rotate all app-limited API keys; (2) restrict API key generation to administrators only via role-based access controls; (3) implement API request logging and alerting on /functions/v1/apikey endpoint activity; (4) require secondary authentication (MFA/2FA) before any API key operations; (5) network-segment or rate-limit the /functions/v1/apikey endpoint if feasible; (6) implement API key expiration policies (e.g., 90-day rotation cycles) to limit exposure window of any undetected compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Capgo Authentication and Authorization Flaws
View all 5Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Exploit-DB