Capgo CVE-2026-56302

No special conditions are required - the CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms zero privileges, low complexity, and no special attack requirements. Any network-reachable Capgo instance running a version prior to 12.128.2 is exploitable without authentication against its Supabase images bucket endpoint. Exploitation is bounded in scope: an attacker can only access the images storage bucket and its associated metadata (app IDs, user IDs), and cannot leverage this flaw alone to reach other Supabase tables, authentication credentials, application source code, or other Capgo storage buckets. Self-hosted deployments with publicly exposed Supabase endpoints face the highest exposure; deployments with network-layer restrictions on the Supabase storage API have a reduced but not eliminated attack surface.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) confirms unauthenticated, network-accessible, low-complexity exploitation - a very low barrier to exploitation. However, the impact metrics are constrained: confidentiality loss is Low (app IDs and user IDs exposed, not credentials or source code), integrity loss is Low (icons can be tampered with or deleted), and availability impact is None per the vector. This is consistent with the description's scope, which is limited to the images bucket and does not imply lateral movement to other Supabase tables or broader system compromise. No CISA KEV listing exists and no public exploit code has been identified, suggesting this is not under active widespread exploitation. Real-world risk is best characterized as moderate-low: trivial to exploit with zero authentication, but the blast radius is confined to icon storage and associated metadata leakage. Self-hosted Capgo deployments with publicly reachable Supabase endpoints face higher exposure than managed deployments where network controls may limit direct bucket access.

An unauthenticated attacker sends HTTP GET requests directly to the Capgo deployment's Supabase storage API endpoint for the images bucket, receiving a full listing of stored app icons along with object metadata containing app IDs and user IDs - no credentials or tokens required. The attacker then issues HTTP DELETE requests to systematically remove all icons, causing visual degradation for end users of Capgo-managed applications. No exploit code is required beyond standard HTTP tooling given the absence of any access controls.