EUVD-2026-43225
GHSA-4w58-4949-9w2m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint (AV:N/AC:L) requires app-scoped API key (PR:L); no scope change despite boundary crossing; limited confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check.
AnalysisAI
Scope isolation failure in Capgo's POST /webhooks/test endpoint allows authenticated app-scoped API keys to invoke org-scoped webhook operations, bypassing the intended limited_to_apps authorization boundary. All Capgo instances prior to version 12.128.2 are affected, enabling credential holders with narrow, app-level access to trigger signed outbound webhook deliveries targeting arbitrary organization webhooks they should not control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 vector (PR:L, AV:N) confirms low-privilege network exploitation is straightforward once credentials are in hand.
Technical ContextAI
Capgo is a cloud and self-hosted over-the-air (OTA) update platform for Capacitor mobile applications, providing API key-based access control segmented at two levels: app-scoped keys (limited to a specific application) and org-scoped keys (organization-wide authority). The affected component is the POST /webhooks/test REST API endpoint, which is designed to fire a test delivery for a webhook. The root cause is CWE-863 (Incorrect Authorization): the endpoint fails to validate that the webhook identified in the request belongs to the same application boundary as the presenting API key, allowing the limited_to_apps check to be bypassed entirely. CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all versions up to but not including 12.128.2. Because Capgo signs outbound webhook payloads, the deliveries appear legitimate to receiving endpoints, amplifying downstream trust abuse.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which contains the fix for the limited_to_apps authorization enforcement on POST /webhooks/test. The vendor security advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-qvr7-f6j6-64wp should be consulted for upgrade instructions. If an immediate upgrade is not possible for self-hosted deployments, a compensating control is to restrict network access to the POST /webhooks/test endpoint via API gateway or reverse-proxy rules so that only org-scoped or admin-level tokens (verified at the perimeter) can reach it - however, this trades off webhook testing functionality for all app-scoped users. Additionally, auditing existing app-scoped API key usage logs for unexpected calls to /webhooks/test that reference webhook IDs outside the key's declared application is recommended as a detection step.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today