EUVD-2026-43170
GHSA-fcmv-mqrc-fr3c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with no meaningful auth barrier (publishable key is semi-public); impact is limited to low confidentiality via app ID enumeration only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differences when calling transfer_app with only the publishable API key.
AnalysisAI
Information disclosure in Capgo (Cap-go) before 12.128.2 allows unauthenticated network attackers to enumerate valid app IDs by observing differential error responses from the public.transfer_app RPC endpoint, requiring only a publishable API key. The root cause is a CWE-203 observable discrepancy: the endpoint returns distinguishable error messages depending on whether a supplied app ID exists or not, functioning as an existence oracle. No active exploitation is confirmed (not in CISA KEV), but the low barrier to exploitation - network-accessible, no authentication beyond a publishable key - makes this a practical reconnaissance primitive against Capgo-hosted applications.
Technical ContextAI
Capgo is a live over-the-air (OTA) update platform for apps built with the Capacitor framework, commonly used in cross-platform mobile development. The vulnerability resides in the public.transfer_app RPC function, a backend API endpoint gated only by a publishable API key - a credential class typically embedded in client applications and considered semi-public. CWE-203 (Observable Discrepancy) describes the root cause: the system leaks information through non-uniform responses. Rather than returning a generic error for all unauthorized or invalid transfer attempts, the RPC differentiates between 'app ID does not exist' and 'app ID exists but transfer is unauthorized,' enabling systematic enumeration. The affected CPE is cpe:2.3:a:cap-go:capgo:*:*:*:*:*:*:*:*, covering all versions before 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is confirmed as the first patched release per the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-fmm3-3qcg-85j6. If immediate patching is not possible, a targeted compensating control is to restrict or rate-limit calls to the public.transfer_app RPC endpoint at the API gateway or WAF layer - aggressive rate limiting on this endpoint reduces the speed of enumeration but does not eliminate the oracle entirely. Another option is to rotate publishable API keys and restrict their distribution to reduce the pool of parties who can call the endpoint; however, since publishable keys are often embedded in client apps, full restriction may not be feasible. Normalizing error responses in the transfer_app function to return a single generic message regardless of app ID validity would neutralize the vulnerability architecturally, but this is a code-level fix that requires the upgrade.
Improper access control in Capgo (capgo.app) lets any holder of an ordinary full API key forge a trusted SSO provider by
Authorization bypass in Capgo (capgo.app), a live-update/OTA platform for Capacitor mobile apps, allows a de-provisioned
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Privilege escalation in the Capgo (capgo.app) backend through version 12.242.4 allows an authenticated API key holder to
Capgo's MFA enforcement is defeated by an authentication assurance level (AAL) mismatch across two distinct code paths:
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an exte
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today