EUVD-2026-40434
GHSA-7799-99mf-pchj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable deletion endpoint with no auth check gives PR:N and AC:L, but CSRF/session abuse needs a victim's action so UI:R; impact is account destruction, hence I:H and A:H with C:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.
AnalysisAI
Account takeover-style destruction in Capgo before 12.128.2 lets remote attackers delete arbitrary user accounts because the deletion endpoint enforces no password re-authentication or secondary verification (CWE-306, Missing Authentication for a Critical Function). Reported by VulnCheck, the flaw is exploitable through CSRF, session hijacking, or parameter tampering, causing irreversible account removal, data loss, and denial-of-service. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Capgo is a live/over-the-air update service for Capacitor (Ionic) mobile applications, and the affected component is its web account-management API as identified by the single CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*. The root cause is CWE-306: a critical state-changing function - account deletion - is reachable without re-establishing the user's identity. Sensitive irreversible actions are expected to require step-up authentication (password confirmation, OTP, or a CSRF anti-forgery token); their absence means a valid session cookie, a forged cross-site request, or a manipulated user/account identifier parameter is sufficient to invoke deletion, which aligns with the CVSS UI:A (user interaction) and CSRF tags.
RemediationAI
Upgrade to Capgo 12.128.2 or later, which is the first fixed release per the GitHub Security Advisory GHSA-cjvr-jxp5-4p9x (https://github.com/Cap-go/capgo/security/advisories/GHSA-cjvr-jxp5-4p9x); this is the primary and authoritative fix. If an immediate upgrade is not possible, add a server-side anti-CSRF token requirement to the account-deletion endpoint and enforce password (or OTP) re-authentication before deletion, since these are the exact controls the vulnerability lacks; expect minor UX friction from the extra confirmation step. As compensating controls, set session cookies to SameSite=Strict to blunt cross-site forgery (side effect: may break legitimate cross-site flows if any rely on cookies), shorten session lifetimes to reduce the hijacking window, and restrict or monitor the deletion endpoint for anomalous request origins. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/capgo-account-deletion-without-password-confirmation) for further detail.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today