EUVD-2026-42247
GHSA-g63j-c9m2-fjm9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API abusable by any authenticated read-only member (AV:N/AC:L/PR:L/UI:N); only manifest integrity is affected (I:H, C:N, A:N); scope kept unchanged to align with the input's SC/SI/SA:N.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_path values that are served to devices via the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.
AnalysisAI
Authorization bypass in Capgo before 12.128.2 lets read-only organization members insert rows into the public.manifest table via a flawed INSERT row-level-security policy, poisoning the OTA update manifests that Capacitor apps fetch. Because these forged entries carry attacker-chosen s3_path values and are served to client devices through the unauthenticated /updates endpoint, a low-privileged insider can steer devices toward malicious update assets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already hold a valid read-only organization membership in the target Capgo tenant (PR:L - authenticated per the CVSS vector), and the deployment must be running Capgo before 12.128.2 with the vulnerable public.manifest INSERT row-level-security policy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VI:H and VC/VA:N) frames this as a network-reachable, low-complexity, low-privilege integrity-only flaw - no confidentiality or availability impact - which is consistent with the description: the attacker needs a valid but read-only org account, and the payoff is manifest/metadata tampering rather than data theft or service disruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has been granted (or has phished/compromised) a read-only membership in a Capgo organization uses the authenticated API to insert a crafted manifest row pointing s3_path at an attacker-controlled or malicious asset. Devices polling the unauthenticated /updates endpoint then receive the poisoned manifest and may fetch the malicious OTA payload. … |
| Remediation | Upgrade to Capgo 12.128.2 or later, which corrects the public.manifest INSERT row-level-security policy - Vendor-released patch: 12.128.2 (see GHSA-vmgg-crr8-887p at https://github.com/Cap-go/capgo/security/advisories/GHSA-vmgg-crr8-887p). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit all organization members with Capgo access; obtain list of recent manifest entries and identify any anomalous updates. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today