EUVD-2026-38122
GHSA-99cw-mv92-985v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a valid non-expiring API key (PR:L, AV:N); impact is limited to webhook-scope confidentiality, integrity, and availability with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails to call apikeyHasOrgRightWithPolicy, enabling attackers with legacy non-expiring keys to list, create, and delete webhooks despite explicit organizational policy requiring key expiration.
AnalysisAI
Webhook management endpoints in Capgo before 12.128.2 expose an authorization policy bypass that allows holders of non-expiring API keys to circumvent the organization-level require_apikey_expiration policy. The checkWebhookPermission function omits the required call to apikeyHasOrgRightWithPolicy, leaving webhook operations - listing, creating, and deleting - accessible to legacy non-expiring keys even when the organization has explicitly mandated key expiration. No public exploit has been identified at time of analysis, and exploitation requires prior possession of a valid non-expiring API key, targeting organizations that believed their key-expiration policy was uniformly enforced.
Technical ContextAI
Capgo is a live-update delivery platform for Capacitor-based mobile applications (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-285 (Improper Authorization): the system authenticates the API key holder correctly but fails to enforce the authorization policy governing whether that key is permitted to act. Specifically, checkWebhookPermission - the function gating webhook management operations - does not invoke apikeyHasOrgRightWithPolicy, the routine responsible for evaluating the require_apikey_expiration organizational constraint. This creates a silent policy gap: keys that should be denied access under the org policy pass unchecked through the webhook permission layer, while other platform surfaces that correctly call apikeyHasOrgRightWithPolicy remain protected. The root cause is an incomplete implementation of the policy-enforcement call chain in a single endpoint authorization function.
RemediationAI
The primary fix is to upgrade Capgo to version 12.128.2 or later, which introduces the missing apikeyHasOrgRightWithPolicy call within checkWebhookPermission, closing the policy-enforcement gap. The authoritative vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-vwpp-cqv5-cmfm should be consulted for upgrade guidance. For organizations that cannot patch immediately, the most targeted compensating control is to audit and explicitly revoke all non-expiring API keys - this removes the class of keys that bypass the policy, though it will disrupt any integrations or automation relying on those keys. After any potential exposure window, operators should review webhook configurations for unauthorized additions (potential pivot points for intercepting deployment events) or unauthorized deletions (potential disruption of legitimate deployment pipelines). Restricting network access to Capgo webhook management endpoints to known IP ranges is an additional defense-in-depth measure that reduces the attack surface without functional side effects.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today