EUVD-2026-42883
GHSA-644w-64m3-9c8v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API accessible with a low-privilege upload-scoped key; no scope change, confidentiality breach, or user interaction; limited integrity and availability impact via storage quota bypass.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.
AnalysisAI
Plan quota enforcement is missing on the /files/upload/attachments endpoint in Capgo before 12.128.2, allowing upload-scoped API keys to bypass plan restrictions and create publicly readable Cloudflare R2 objects regardless of account standing. Apps that have been plan-blocked or suspended retain the ability to upload arbitrary attachments that persist outside bundle metadata and survive app deletion, enabling sustained storage and bandwidth abuse against the Capgo platform. No public exploit has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited.
Technical ContextAI
Capgo is a cloud-based live update service for Capacitor mobile applications that uses Cloudflare R2 object storage for file persistence. The affected component is the /files/upload/attachments API endpoint, which handles attachment uploads distinct from core bundle metadata. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) - plan enforcement logic that gates upload operations was absent or ineffective on this specific endpoint while presumably functioning on others. Upload-scoped API keys, a narrowly-scoped credential type intended only for file upload operations, are sufficient to exploit the gap. The resulting R2 objects are created with public read permissions, compounding the abuse potential beyond simple quota exhaustion by enabling unauthorized file hosting. CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* confirms this affects the Capgo application broadly prior to version 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which enforces proper plan and quota restrictions on the /files/upload/attachments endpoint per the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-q52j-ggvx-cr4v. For operators unable to patch immediately, consider temporarily rate-limiting or disabling the /files/upload/attachments endpoint at the API gateway or WAF layer, with the trade-off that this will break legitimate attachment upload functionality for all users. As an additional compensating control, audit and revoke upload-scoped API keys associated with plan-blocked or suspended apps; however, this requires identifying and tracking all affected keys, which may be operationally complex. Implement anomaly monitoring on Cloudflare R2 storage growth and bandwidth consumption to detect ongoing abuse while patching is scheduled. Note that uploaded objects persisting after app deletion may require a manual cleanup sweep of orphaned R2 objects following the upgrade.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today