EUVD-2026-38115
GHSA-383x-vh5q-x2q9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via web UI (AV:N, AC:L); requires organization admin role (PR:L); scope change (S:C) because SSRF crosses into internal systems beyond the application boundary; limited confidentiality and integrity impact from error disclosure and potential internal HTTP manipulation; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.
AnalysisAI
Server-side request forgery in Capgo's webhook URL validation exposes internal infrastructure to organization admins who can direct the backend to issue HTTP requests against loopback and private addresses (localhost, 127.0.0.1). All Capgo versions prior to 12.128.2 are affected per the GitHub Security Advisory GHSA-48hc-53hv-6x3f. The vulnerability is particularly dangerous in cloud-hosted deployments where the backend server can reach instance metadata services (e.g., AWS IMDS), and error responses are disclosed directly to the triggering user, enabling iterative internal network reconnaissance. No public exploit identified at time of analysis and no CISA KEV listing, but the authenticated-admin attack path lowers the effective barrier in multi-tenant SaaS environments.
Technical ContextAI
Capgo is a live-update platform for Capacitor-based mobile applications, providing webhook notifications for deployment events. The vulnerability (CWE-918: Server-Side Request Forgery) resides in webhook URL validation logic: the application accepts user-supplied URLs without adequately filtering RFC 1918 private ranges, loopback addresses (127.0.0.0/8), and link-local ranges (169.254.0.0/16) before the backend issues outbound HTTP requests. The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covering all versions before 12.128.2. Because the backend server initiates the request from its own network context, any service reachable only from the server - including internal APIs, container sidecars, or cloud metadata endpoints - becomes an unintended request target. Error responses from those internal services are surfaced back to the authenticated user, making this a read-and-probe SSRF rather than a blind variant.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the SSRF by implementing proper webhook URL validation that rejects loopback and internal address ranges. The fix is documented in GitHub Security Advisory GHSA-48hc-53hv-6x3f at https://github.com/Cap-go/capgo/security/advisories/GHSA-48hc-53hv-6x3f. If immediate patching is not feasible, apply network-level egress filtering on the Capgo backend to block outbound connections to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16 - this eliminates the effective attack surface without application changes, though it does not remediate the underlying code defect and may break legitimate internal webhook destinations. Additionally, restrict the organization admin role to only fully trusted users as a privilege-minimization control; note this is a scope-reduction measure rather than a fix. For cloud deployments, enforce IMDSv2 (requiring session tokens) on backend instances to prevent metadata credential extraction even if SSRF requests reach 169.254.169.254.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today