EUVD-2026-38430
GHSA-2c7m-fxr4-462c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PostgREST endpoint (AV:N/AC:L), requires a valid plaintext API key so PR:L not PR:N, no UI, high C/I over tenant data, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.
AnalysisAI
Authentication bypass in Capgo before 12.128.2 allows authenticated attackers to defeat the org-level hashed-API-key control by submitting plaintext API keys via the capgkey header directly to the PostgREST/RLS plane. Despite the enforce_hashed_api_keys setting being toggled on, the data plane fails to honor that policy, granting access to protected resources. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Capgo is a self-hostable live-update and OTA platform for Capacitor mobile applications that fronts its data with PostgREST and PostgreSQL Row-Level Security (RLS). API authentication is intended to flow through an org-level toggle, enforce_hashed_api_keys, which should require callers to present hashed keys rather than the original plaintext secret. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) captures the root cause: the PostgREST/RLS plane is an alternate authentication path that does not honor the enforcement policy, so the capgkey header continues to accept plaintext API keys and resolves them to a valid identity even when the org has explicitly opted into hashed-only enforcement. The single affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* up to version 12.128.2.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, as documented in the GitHub Security Advisory GHSA-6g74-8cpq-g2c8 (https://github.com/Cap-go/capgo/security/advisories/GHSA-6g74-8cpq-g2c8) and the VulnCheck writeup (https://www.vulncheck.com/advisories/capgo-hashed-api-key-enforcement-bypass-via-postgrest-rls-plane). Until the upgrade is applied, treat enforce_hashed_api_keys as non-binding and rotate any plaintext API keys that were issued prior to enabling hashed enforcement, since attackers can still present them via the capgkey header; additionally consider network-restricting the PostgREST/RLS plane so it is only reachable from the Capgo application tier and not from arbitrary internet clients, accepting that this will break any integrations that talk to PostgREST directly. Auditing recent PostgREST access logs for capgkey header values that look like plaintext (rather than hashed) keys is a useful detection-side compensating control with the side effect that it requires log retention you may not have today.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today