Which versions of Capgo are affected by CVE-2026-56250?

Capgo, the over-the-air update platform used by mobile app teams, contains a cross-tenant vulnerability allowing one customer to delete another customer's application bundles, disrupting end-user app…. A patch is available.

How to fix or mitigate CVE-2026-56250?

Within 24 hours: audit all Capgo upload-scoped API keys, revoke unused credentials, and implement least-privilege access controls for API key usage. Within 7 days: enable CloudFlare R2 logging and alerting for object deletion events, and monitor Capgo update delivery metrics for anomalies. Within 30 days: monitor vendor advisories for Capgo security patch release and upgrade when available; implement backup and recovery procedures for application bundles independent of Capgo platform.

Capgo CVE-2026-56250

Q: What is the CVSS score of CVE-2026-56250?

CVE-2026-56250 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42250 HIGH

Missing Authorization (CWE-862)

2026-07-08 disclosure@vulncheck.com

GHSA-8jvj-57hc-9w8w

Authentication Bypass Denial Of Service

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 15:01 EUVD

Analysis Generated

Jul 08, 2026 - 14:45 vuln.today

DescriptionCVE.org

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.

AnalysisAI

Cross-tenant bundle deletion in Capgo (Capacitor live/OTA update platform) before 12.128.2 lets holders of an upload-scoped API key rewrite the mutable app_versions.r2_path column through the PostgREST data API, retargeting it at another tenant's Cloudflare R2 objects. By pointing a soft-deleted attacker version at a victim bundle and firing the on_version_update cleanup trigger, an attacker deletes the victim's R2 object, breaking that app's over-the-air update delivery. No public exploit is identified at time of analysis, but the mechanism is fully described and CVSS 4.0 rates availability impact as High (8.7).