EUVD-2026-38749Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication required (AV:N, PR:N); impact confined to icon bucket metadata leakage (C:L) and icon deletion/insertion (I:L), with no availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
AnalysisAI
Unauthenticated remote attackers can read, insert, and delete stored app icons in Capgo (all versions before 12.128.2) due to a Supabase images bucket entirely lacking row-level security (RLS) controls. Exploitation leaks sensitive app IDs and user IDs embedded in bucket metadata, and enables full icon deletion causing visual degradation of hosted applications. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 12.128.2.
Technical ContextAI
Capgo is an open-source live update platform for Capacitor-based mobile apps that uses Supabase as its backend storage layer. Supabase implements per-table and per-bucket access control through PostgreSQL row-level security (RLS) policies, which restrict which rows or objects a given user role can SELECT, INSERT, UPDATE, or DELETE. The affected component - the images bucket - has no RLS policies applied, meaning any caller, including fully unauthenticated requests, is permitted full CRUD access via the Supabase storage REST API. The root cause class is CWE-284 (Improper Access Control): there is no authorization enforcement at the data layer for this storage bucket. The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, covering all versions prior to 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is confirmed by the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-8hq3-gg3m-vwvr to introduce proper RLS controls on the images bucket. For self-hosted deployments where an immediate upgrade is not feasible, a compensating control is to manually define PostgreSQL RLS POLICY statements on the Supabase images bucket, restricting SELECT, INSERT, and DELETE operations to authenticated sessions with appropriate role grants - this requires Supabase admin access and must be validated to avoid breaking icon loading in the application. Network-layer controls (e.g., restricting public access to the Supabase storage endpoint via firewall rules or Supabase project settings) can further reduce exposure but do not address the underlying missing access control. Cloud-hosted Capgo deployments should confirm with the Capgo team whether the server-side fix has been applied.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today