EUVD-2026-38365Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requiring low-privilege org credentials; no confidentiality or integrity impact; availability impact is limited and contained to the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to create unlimited demo applications without rate limiting or quota enforcement. Attackers can repeatedly invoke this endpoint to generate approximately 138 database write operations per request, causing degraded performance, increased costs, and potential service instability.
AnalysisAI
Unenforced resource limits on the POST /app/demo endpoint in Capgo before 12.128.2 allow any authenticated user holding org write permissions to create unlimited demo applications, each triggering approximately 138 database write operations. Sustained abuse degrades platform performance, inflates infrastructure costs, and can cause service instability for all tenants sharing the backend. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation complexity for any org-level member makes compromised-account or insider-threat scenarios operationally realistic.
Technical ContextAI
Capgo is an open-source live-update delivery platform for Capacitor-based mobile applications. The vulnerable component is the demo application provisioning endpoint (POST /app/demo), which performs no rate limiting, request throttling, or per-user/per-org quota enforcement - a textbook CWE-770 (Allocation of Resources Without Limits or Throttling) weakness. The high write amplification factor (~138 discrete database operations per single API call) makes even moderate request repetition disproportionately expensive relative to the caller's effort. The CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all Capgo releases prior to the 12.128.2 fix boundary.
RemediationAI
Upgrade to Capgo 12.128.2 or later, which resolves this issue per the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-q2xx-6h9x-43fw. If immediate upgrade is not feasible, restrict org write permissions to the minimum necessary set of trusted users; note this may impact legitimate demo provisioning workflows. As a secondary compensating control, deploying a reverse proxy or API gateway with per-user or per-org rate limiting on the POST /app/demo path can significantly reduce abuse risk with minimal operational impact, though it does not address the root cause. Monitor database write throughput for anomalous spikes as a detection signal.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today