EUVD-2026-40428
GHSA-r799-c3x3-8633
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable proxy with low complexity, but requires an authenticated build-permission account (PR:L); high confidentiality/integrity impact via SSRF to admin endpoints, low availability, scope unchanged per advisory.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.
AnalysisAI
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a path-traversal flaw in the builder upload proxy to reach internal administrative endpoints. By appending traversal sequences to the upload path - which the WHATWG URL parser normalizes - an attacker pivots requests carrying the privileged BUILDER_API_KEY header, turning limited build access into SSRF and elevated server-side privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Capgo account that already holds build permissions (CVSS PR:L), and the target must be a Capgo instance before version 12.128.2 whose builder upload proxy uses the WHATWG URL parser to normalize the upload path and forwards requests with the BUILDER_API_KEY header. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) and low availability impact (VA:L); subsequent-system metrics are N, so the formal scoring treats impact as confined to the vulnerable system despite the privilege-escalation framing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a Capgo account with build permissions crafts an upload request whose path contains '../' traversal sequences. The WHATWG URL parser normalizes the path so the proxy forwards the request - carrying the privileged BUILDER_API_KEY header - to an internal administrative endpoint, granting the attacker elevated server-side capabilities (SSRF). … |
| Remediation | Vendor-released patch: 12.128.2 - upgrade Capgo to 12.128.2 or later, as referenced in GitHub Security Advisory GHSA-qprp-873h-mx6f (https://github.com/Cap-go/capgo/security/advisories/GHSA-qprp-873h-mx6f). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Capgo deployments for versions before 12.128.2 and document current versions in use; immediately restrict build permissions to essential personnel only and review recent build activity logs for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today