EUVD-2026-38744Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Capgo user
-
DeliveryIdentify target app id
-
ExploitSend direct PATCH to apps.owner_org via PostgREST
-
ExecutionBypass transfer_app() workflow
-
PersistCreate split-brain ownership across apps and app_versions
-
ImpactRetain or hijack access to version artifacts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session with a low-privileged Capgo role that is permitted to call PostgREST against the public.apps table (PR:L in the CVSS vector), network reachability to the Capgo PostgREST API, and a Capgo instance running a version older than 12.128.2 where column-level permissions on apps.owner_org are not enforced. No user interaction, no non-default configuration, and no special platform is needed - any Capgo deployment exposing PostgREST as designed is in scope. Exploitation is limited to tenants whose accounts can authenticate to the API; fully unauthenticated outsiders cannot reach the vulnerable endpoint. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H) scores 7.1 and is internally consistent with the description: network-reachable PostgREST endpoint, low complexity, and an authenticated low-privileged user is sufficient - the integrity impact is High because attackers can corrupt ownership records, while confidentiality is only Low (leakage limited to version data) and availability is unaffected. There is no EPSS score, KEV listing, or known POC supplied with this report, which together with the PR:L requirement suggests this is a real but targeted authorization flaw rather than an opportunistically wormable issue. No conflicting signals were observed in the input; the main unknown is the deployment footprint of self-hosted Capgo instances versus the managed SaaS, which affects how broadly the bug can be reached. |
| Exploit ScenarioDerived | An attacker with a valid low-privileged Capgo account (for example, a member of a tenant organization) sends an authenticated PATCH /apps?id=eq.<target> request to the Capgo PostgREST endpoint setting owner_org to an attacker-controlled organization. Because the transfer_app() workflow is skipped, app_versions.owner_org is left untouched, so the original org's API keys keep reading and shipping version artifacts while the attacker's org now owns the app record and can manipulate downstream metadata. No public exploit code has been identified, but the attack is straightforward HTTP and low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Authorization bypass in Capgo before 12.128.2 allows authenticated users to directly modify the public.apps.owner_org column via PostgREST, circumventing the intended transfer_app() workflow. Successful exploitation creates a split-brain ownership state where apps.owner_org and app_versions.owner_org diverge, letting the original organization's API keys retain access to version data while the new owning organization controls the app record. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which tightens PostgREST/PostgreSQL permissions so that public.apps.owner_org can no longer be PATCHed directly and ownership transfers must flow through the transfer_app() function; see GHSA-v9jp-r5wh-qqcp for details. If immediate upgrade is not possible, revoke UPDATE privilege on the owner_org column (or the apps table) from the authenticated PostgREST role and require all transfers via the transfer_app() RPC, accepting that any client tooling that PATCHes apps rows will break until updated, and audit current rows for divergence between apps.owner_org and app_versions.owner_org to detect prior abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a self-hostable live-update / OTA delivery platform for Capacitor mobile apps that exposes its PostgreSQL schema through PostgREST, an auto-generated REST API for Postgres. The vulnerability is rooted in CWE-284 (Improper Access Control): row-level security or column-level permissions on the public.apps table allowed direct PATCH operations against owner_org instead of forcing callers through the transfer_app() stored procedure, which is the only path that atomically updates both apps.owner_org and the dependent app_versions.owner_org. Because PostgREST faithfully exposes whatever the underlying role is allowed to do, a permission gap at the database layer becomes an API-level authorization bypass.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable PostgREST API, low complexity, authenticated low-privileged user (PR:L), no UI; integrity High due to ownership tampering, confidentiality Low, availability unaffected.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owner_org unchanged, enabling old-org keys to retain access to version data while new-org keys control the app record.
Executive ViewAI
Capgo versions before 12.128.2 contain an authorization flaw allowing authenticated users to reassign application ownership, creating a condition where both original and new owners retain partial system access. For organizations using Capgo to manage applications, this risks loss of administrative control and potential unauthorized access to application data and active API credentials.
No vendor-released patch identified at time of analysis. Restrict PostgREST API access to application ownership metadata fields using database role-based permissions, limit authenticated user privileges to prevent unauthorized ownership modifications, implement comprehensive audit logging for app ownership changes, and establish continuous monitoring for suspicious ownership transfer attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Exploit-DB