EUVD-2026-40435
GHSA-33gg-4g7f-39f7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse two SECURITY DEFINER RPC functions, get_user_id and get_org_perm_for_apikey, reachable with only the public/anon API key. Attackers can confirm whether a leaked API key is valid, resolve user UUIDs, and read the permission level tied to a key, turning otherwise-uncertain credential leaks into actionable, scoped targets. CVSS 4.0 is 8.7 (High); there is no public exploit identified at time of analysis and it is not in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.
Executive ViewAI
Capgo, a critical OTA/live-update platform for mobile app deployments, contains an unauthenticated information-disclosure vulnerability (CVSS 8.7) that enables attackers to validate leaked API credentials and extract sensitive account and permission data. Any organization using Capgo with exposed API keys faces immediate risk of targeted attacks against its deployment infrastructure.
Within 24 hours: Identify all Capgo instances; verify current versions; audit for API key exposure in logs and configurations. Within 7 days: Upgrade all instances to Capgo version 12.128.2 or later; rotate all API keys immediately post-upgrade; review access logs for exploitation of get_user_id and get_org_perm_for_apikey functions. Within 30 days: Verify patch deployment across all environments; implement API key rotation policy with 90-day maximum lifetime.
Apply vendor patch (Capgo 12.128.2 or later). Interim controls during patch deployment: disable public API key access to RPC functions if feasible; implement IP whitelisting for Capgo API endpoints; establish continuous monitoring for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Exploit-DB