EUVD-2026-38427
GHSA-whmp-h7x8-7x69
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API, low complexity, requires org-admin (PR:H); cross-tenant impact gives S:C with high C/I on victim org; no direct availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.
AnalysisAI
Cross-tenant authorization bypass in Capgo before 12.128.2 allows organization administrators to attach role bindings to applications owned by other organizations via the POST /private/role_bindings endpoint, which validates org membership but not app_id ownership. Successful exploitation grants unauthorized read and modification access to victim applications across tenant boundaries. No public exploit identified at time of analysis, but a vendor advisory (GHSA-5r52-m8r9-7f8x) and VulnCheck disclosure confirm the issue.
Technical ContextAI
Capgo is a self-hostable live-update and over-the-air delivery platform for Capacitor mobile applications, providing multi-tenant management of apps, channels, and team role assignments. The affected /private/role_bindings endpoint performs app-scoped role assignment but only verifies that the caller has administrative privileges within their own organization, not that the supplied app_id actually belongs to that organization - a classic CWE-639 (Authorization Bypass Through User-Controlled Key) flaw where an authenticated identifier (app_id) is trusted as a tenancy scope without server-side ownership validation. The CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* indicates all Capgo versions prior to 12.128.2 are in scope.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds the missing app_id ownership check on POST /private/role_bindings - see the GitHub Security Advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-5r52-m8r9-7f8x. If immediate upgrade is not possible, restrict network access to the /private/role_bindings endpoint to trusted operators via a reverse proxy or WAF rule (side effect: blocks legitimate org admins from self-service role management), and audit existing role_bindings rows to detect any rows where the binding's organization does not match the owning organization of its app_id, revoking and alerting on mismatches. On managed Capgo SaaS, treat all multi-org tenants as potentially impacted and rotate any app-level secrets or credentials that could have been exposed through unauthorized read access.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today