EUVD-2026-38124
GHSA-gh9r-qcpc-q754
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authenticated app.read_devices access (PR:L); no scope change, no confidentiality or integrity impact, availability impact limited to pagination disruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.
AnalysisAI
Broken cursor pagination in Capgo's /private/devices endpoint on the Cloudflare/workerd runtime path allows authenticated attackers with app.read_devices permission to trigger infinite duplicate-page loops, making later dataset rows permanently unreachable for affected sessions. All Capgo versions before 12.128.12 are vulnerable, and the impact is operational: device-management workflows repeatedly process the same duplicate records while failing to advance through the full dataset. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 5.3 (Medium) reflects limited, availability-only impact scoped to the vulnerable system.
Technical ContextAI
Capgo is an over-the-air (OTA) update platform for Capacitor-based mobile apps. The /private/devices endpoint provides paginated access to registered device records. On the Cloudflare Workers (workerd) runtime path, the cursor-based pagination implementation contains a logic flaw classified as CWE-670 (Always-Incorrect Control Flow Implementation): the cursor token used to advance through dataset pages fails to update correctly, causing repeated return of the same first page rather than progressing through subsequent rows. Cursor-based pagination is a common pattern in distributed data APIs where offset-based pagination is impractical; a broken cursor anchor effectively creates an unbounded loop condition at the API level. Affected product per CPE: cpe:2.3:a:cap-go:capgo:*:*:*:*:*:*:*:* covering all versions from 0 up to (but not including) 12.128.12. The flaw is specific to the Cloudflare/workerd execution path and may not manifest on alternative deployment runtimes.
RemediationAI
Upgrade Capgo to version 12.128.12 or later, which contains the vendor-released patch correcting the cursor advancement logic in the /private/devices pagination implementation. The authoritative vendor advisory is at https://github.com/Cap-go/capgo/security/advisories/GHSA-8p6w-x7jg-v4xq. If immediate upgrade is not feasible, restrict app.read_devices permission to the minimum required set of trusted service accounts, reducing the pool of principals who can trigger the pagination loop; note this does not eliminate the flaw but limits exposure to already-trusted identities. Additionally, implementing server-side or API-gateway rate limiting on /private/devices requests per authenticated principal can bound the operational disruption caused by infinite pagination loops, though it may also impact legitimate high-frequency polling by device-management workflows. Neither workaround eliminates the root cause and should be treated as temporary measures only until the patch is applied.
Improper access control in Capgo (capgo.app) lets any holder of an ordinary full API key forge a trusted SSO provider by
Authorization bypass in Capgo (capgo.app), a live-update/OTA platform for Capacitor mobile apps, allows a de-provisioned
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Privilege escalation in the Capgo (capgo.app) backend through version 12.242.4 allows an authenticated API key holder to
Capgo's MFA enforcement is defeated by an authentication assurance level (AAL) mismatch across two distinct code paths:
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an exte
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today