EUVD-2026-38171
GHSA-33r3-cpxm-4xg2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no privileges or interaction needed; impact is limited to low availability disruption with no confidentiality or integrity consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors. Remote attackers can send OPTIONS requests to bypass authentication middleware and invoke tusProxy logic with invalid credentials, enabling trivial request flooding and denial of service.
AnalysisAI
Authentication bypass in Capgo's /build/upload/:jobId/* endpoint exposes all versions before 12.128.2 to unauthenticated denial of service. Remote attackers exploit HTTP OPTIONS request handling to sidestep authentication middleware entirely, forcing tusProxy to execute with invalid credentials and reliably producing HTTP 500 errors at scale. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial attack mechanics - requiring no credentials, tools, or interaction - mean any internet-exposed Capgo instance is at risk of request flooding.
Technical ContextAI
Capgo (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*) is a live update deployment platform for Capacitor applications. The affected endpoint /build/upload/:jobId/* implements a file-upload proxy using the tus resumable upload protocol (tusProxy). The root cause is CWE-306 (Missing Authentication for Critical Function): the authentication middleware does not intercept HTTP OPTIONS requests, treating them as benign preflight checks rather than functional API calls. Because tusProxy is invoked regardless of credential validity when reached via OPTIONS, attackers can bypass the auth layer entirely and drive the server into an error state, producing consistent HTTP 500 responses. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no network constraints or special attack conditions are required.
RemediationAI
Upgrade Capgo to version 12.128.2 or later; this is the vendor-confirmed fix per the GitHub security advisory GHSA-6c7m-4223-446j. If immediate patching is not feasible, a targeted workaround is to configure a reverse proxy or WAF rule to reject HTTP OPTIONS requests to the /build/upload/ path prefix, preventing authentication bypass at the network edge - note this may interfere with legitimate CORS preflight handling if OPTIONS is used by the tus client for that purpose, so test before deploying. Alternatively, restricting access to the /build/upload/:jobId/* endpoint to known CI/CD IP ranges via firewall policy reduces the attack surface without affecting normal authenticated workflows. Do not rely on rate limiting alone as the primary control, since the attack generates consistent 500 errors that may cascade before rate limits engage.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today