EUVD-2026-38427
GHSA-whmp-h7x8-7x69
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API, low complexity, requires org-admin (PR:H); cross-tenant impact gives S:C with high C/I on victim org; no direct availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.
AnalysisAI
Cross-tenant authorization bypass in Capgo before 12.128.2 allows organization administrators to attach role bindings to applications owned by other organizations via the POST /private/role_bindings endpoint, which validates org membership but not app_id ownership. Successful exploitation grants unauthorized read and modification access to victim applications across tenant boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold administrative privileges in at least one Capgo organization (trivially obtained on any instance permitting self-service organization creation, including the hosted SaaS), must reach the /private/role_bindings HTTP endpoint over the network, and must know or guess the target app_id of a victim organization's application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 and accurately captures the situation: network-reachable API, low complexity, but requires high privileges (administrative role in some organization) and yields high confidentiality, integrity, and availability impact on victim tenants. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker signs up for a Capgo account, creates their own organization, and grants themselves admin in it, then sends a POST to /private/role_bindings supplying their own org_id together with the app_id of a victim organization's application - the server accepts the binding because it only checks org admin status, granting the attacker a role over the victim app. The attacker then reads or modifies the victim application's bundles, channels, and update configuration, potentially pushing a malicious OTA update to end users. … |
| Remediation | Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds the missing app_id ownership check on POST /private/role_bindings - see the GitHub Security Advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-5r52-m8r9-7f8x. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Capgo instances; identify users with organization administrator privileges; search access logs for POST /private/role_bindings calls with cross-organization app_id references; document any suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today