Which versions of Capgo are affected by CVE-2026-56220?

Capgo's OTA update service contains an authorization bypass allowing read-only insiders to inject malicious application updates that deploy automatically to customer mobile devices.. A patch is available.

How to fix or mitigate CVE-2026-56220?

24 hours: Audit all organization members with Capgo access; obtain list of recent manifest entries and identify any anomalous updates. 7 days: Request guidance from Capgo support on affected versions (prior to 12.128.2) and interim hardening options; review application update logs for suspicious s3_path values. 30 days: Deploy monitoring on the public.manifest table to flag unexpected INSERTs; validate all s3_path references against known good artifacts before client delivery; prepare alternate update distribution method if poisoning is confirmed.

Capgo CVE-2026-56220

Q: What is the CVSS score of CVE-2026-56220?

CVE-2026-56220 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42247 HIGH

Incorrect Authorization (CWE-863)

2026-07-08 disclosure@vulncheck.com

GHSA-g63j-c9m2-fjm9

Authentication Bypass

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable API abusable by any authenticated read-only member (AV:N/AC:L/PR:L/UI:N); only manifest integrity is affected (I:H, C:N, A:N); scope kept unchanged to align with the input's SC/SI/SA:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 15:01 EUVD

Analysis Generated

Jul 08, 2026 - 14:40 vuln.today

DescriptionCVE.org

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_path values that are served to devices via the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.

AnalysisAI

Authorization bypass in Capgo before 12.128.2 lets read-only organization members insert rows into the public.manifest table via a flawed INSERT row-level-security policy, poisoning the OTA update manifests that Capacitor apps fetch. Because these forged entries carry attacker-chosen s3_path values and are served to client devices through the unauthenticated /updates endpoint, a low-privileged insider can steer devices toward malicious update assets. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Capgo is an open-source live/over-the-air (OTA) update service for Capacitor mobile apps (a CodePush-style alternative) that stores update manifests in a Postgres/Supabase-style database and delivers assets referenced by S3 paths. The root cause is CWE-863 (Incorrect Authorization): the row-level-security INSERT policy on the public.manifest table fails to restrict writes to sufficiently privileged roles, so an account holding only read-only organization membership can still create manifest rows. Since the /updates delivery endpoint is unauthenticated and trusts the s3_path field embedded in each manifest row, control over that field translates directly into control over what binary/asset URL a device is instructed to download.

RemediationAI

Upgrade to Capgo 12.128.2 or later, which corrects the public.manifest INSERT row-level-security policy - Vendor-released patch: 12.128.2 (see GHSA-vmgg-crr8-887p at https://github.com/Cap-go/capgo/security/advisories/GHSA-vmgg-crr8-887p). If immediate upgrade is not possible, tighten the RLS INSERT policy on the public.manifest table so that only org admin/owner roles (not read-only members) can insert rows, and audit existing manifest rows for unexpected or externally-controlled s3_path values before they are served; both steps require database-level access and should be validated against Capgo's release migration to avoid diverging from the official fix. As a compensating control you can also restrict who holds org membership and rotate/review read-only member credentials, and monitor the /updates endpoint responses for unexpected asset paths - the trade-off is operational overhead and that manual policy edits may be overwritten on the next upgrade. Cross-reference the VulnCheck advisory (https://www.vulncheck.com/advisories/capgo-unauthorized-manifest-insertion-via-read-only-org-member) for confirmation details.