EUVD-2026-38164
GHSA-fp2v-g9f3-6fwg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint exploitable by any low-privilege API-key holder with no user interaction; cross-tenant data exposure is a scope change with high confidentiality impact and no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched app_id and job_id combination. Limited API keys restricted to a single app can retrieve build status and logs from other apps by providing an authorized app_id while using a job_id from an unauthorized app, exposing sensitive build information including logs, metadata, and potentially credentials.
AnalysisAI
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated API clients read build status and logs belonging to other applications by combining an authorized app_id with a job_id from a different, unauthorized app. The /build/status and /build/logs endpoints validate the app_id but fail to verify that the supplied job_id actually belongs to that application, exposing logs, metadata, and potentially embedded credentials across tenant boundaries. No public exploit identified at time of analysis, though VulnCheck has published an advisory with technical details.
Technical ContextAI
Capgo is a self-hostable and SaaS over-the-air (OTA) update platform for Capacitor mobile apps, where customers create per-app API keys scoped to a single application to trigger and inspect native build jobs. The flaw is a classic CWE-639 Authorization Bypass Through User-Controlled Key: the build endpoints treat app_id and job_id as independent authorization inputs rather than verifying the relational invariant that the job_id was created under the same app_id. Because job identifiers appear to be globally unique but not access-controlled relative to their parent application, any caller holding a valid limited API key for any app on the platform can dereference jobs owned by other tenants through Insecure Direct Object Reference on the /build/status and /build/logs routes.
RemediationAI
Upgrade Capgo to 12.128.2 or later, which is the vendor-released patch referenced in the GHSA-2fw5-mcrx-wcqw advisory, and follow the guidance at https://github.com/Cap-go/capgo/security/advisories/GHSA-2fw5-mcrx-wcqw. Operators of self-hosted instances who cannot immediately upgrade should rotate any API keys and any secrets that may have appeared in recent build logs, since exposure cannot be ruled out retroactively, and should review access logs for /build/status and /build/logs requests where the requesting key's owning app does not match the job's owning app. As a temporary compensating control, restrict the /build/status and /build/logs endpoints at a reverse proxy to internal addresses or to a small allow-list of CI callers - accepting the trade-off that legitimate customer-facing build dashboards will break - and consider invalidating outstanding limited API keys until the upgrade is in place.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today