EUVD-2026-40427
GHSA-fmx4-fw5w-86gg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API, low complexity, and a low-privilege account suffice (PR:L), with full cross-tenant read/write impact (C/I/A:H); scope unchanged as impact stays within the Capgo app.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.
AnalysisAI
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited API key by supplying its identifier in the client-controlled x-limited-key-id header, which middlewareKey() trusts without checking ownership. Any low-privilege account can therefore read and act on resources belonging to other tenants across multiple API endpoints. No public exploit identified at time of analysis, though the flaw is trivially reproducible once the key-ID format is known.
Technical ContextAI
Capgo is a live/over-the-air (OTA) update service for Capacitor mobile apps, letting developers ship JavaScript bundle updates without app-store review; its backend API is multi-tenant and uses 'limited keys' (scoped API keys) for delegated access. The defect is a CWE-639 (Authorization Bypass Through User-Controlled Key) issue: the middlewareKey() authentication middleware reads the x-limited-key-id request header and resolves the corresponding limited key without verifying that the key belongs to the calling tenant/identity. Because the key identifier is an Insecure Direct Object Reference fully controlled by the client, the server conflates 'knows a key ID' with 'owns that key', collapsing the tenant isolation boundary that the API otherwise relies on. The single affected component is the Capgo backend (cpe:2.3:a:capgo:capgo), so all consumers of the hosted/self-hosted API before the fixed release are exposed.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds ownership validation in middlewareKey() so that a supplied x-limited-key-id is only honored when it belongs to the authenticated identity; follow the upgrade guidance in GHSA-cppm-733w-hg86 (https://github.com/Cap-go/capgo/security/advisories/GHSA-cppm-733w-hg86). If you cannot upgrade immediately on a self-hosted deployment, the targeted compensating control is to strip or reject the x-limited-key-id header at an upstream proxy/WAF for requests that do not legitimately use limited keys, or to enforce a tenant-scoped allowlist mapping each authenticated identity to its own key IDs before requests reach middlewareKey() - both reduce exposure but can break any legitimate limited-key delegation workflows, so validate against your integration patterns. Rotating limited keys and auditing API logs for cross-tenant x-limited-key-id values is also advisable to detect prior abuse, with the trade-off that key rotation requires re-provisioning downstream consumers.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today