EUVD-2026-38102
GHSA-cr4w-2ppq-m3wq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint, no special conditions, requires a low-privilege app-limited key (PR:L), no user interaction; scope changes from scoped key to org-wide resources (S:C) with full CIA impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key can create an unrestricted key with org-wide access to resources like app listings and other protected endpoints.
AnalysisAI
Privilege escalation in Capgo before 12.128.2 allows holders of app-limited API keys to mint new unrestricted keys via the POST /functions/v1/apikey endpoint by submitting empty limit fields. The flaw effectively bypasses the API key scoping model, granting org-wide access to app listings and other protected resources from any compromised low-privilege key. No public exploit identified at time of analysis, but a vendor advisory (GHSA-2ff8-7h96-hwfp) and a VulnCheck writeup confirm the issue.
Technical ContextAI
Capgo is an open-source live-update and over-the-air (OTA) deployment platform for Capacitor mobile apps, exposing a Supabase-backed serverless API under /functions/v1/. The vulnerable endpoint, POST /functions/v1/apikey, generates new API keys but fails to enforce that a child key's limits remain a subset of the requesting key's limits. The root cause maps to CWE-269 (Improper Privilege Management): the server treats an empty limits object as 'no restrictions' rather than rejecting or inheriting from the caller, so a scoped (app-limited) key is allowed to author an unscoped peer. The affected CPE is cpe:2.3:a:capgo:capgo, covering all releases prior to 12.128.2.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, per the GitHub Security Advisory GHSA-2ff8-7h96-hwfp (https://github.com/Cap-go/capgo/security/advisories/GHSA-2ff8-7h96-hwfp). Operators who cannot immediately update should rotate and revoke all existing app-limited API keys (since any could have been used to mint unrestricted peers), audit the apikeys table for keys with empty or null limit fields created prior to the upgrade, and restrict ingress to /functions/v1/apikey behind an authenticated proxy that rejects requests carrying app-limited tokens - recognizing this will break legitimate self-service key creation flows for scoped clients until the patch is applied.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today