EUVD-2026-38371Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable /updates path with low-privileged authenticated channel operator (PR:L); integrity-high because attacker controls code shipped to devices, availability-low, no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. Attackers can continue deploying deleted bundles to devices by exploiting the missing app_versions.deleted filter in channel version joins.
AnalysisAI
Logic flaw in Capgo before 12.128.12 lets authenticated attackers continue serving soft-deleted application bundles to end-user devices because the /updates endpoint omits an app_versions.deleted filter when joining channels. Affected operators of the Capgo live-update service (a CodePush-style OTA platform for Capacitor mobile apps) can have purged bundles re-selected and pushed downstream, undermining rollback and removal workflows. No public exploit identified at time of analysis and the issue is not present in CISA KEV.
Technical ContextAI
Capgo is an open-source live-update / OTA platform for Capacitor-based mobile applications, providing the channel-and-bundle model popularized by CodePush. Updates are resolved by the /updates endpoint, which joins the channels table against the app_versions table to pick the bundle a device should receive. The vulnerability is rooted in CWE-672 (Operation on a Resource after Expiration or Release): the join does not include the deleted flag on app_versions, so soft-deleted bundles remain reachable as if they were still active resources. The single affected product, per the CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, is the Capgo backend itself, with all versions prior to 12.128.12 vulnerable.
RemediationAI
Vendor-released patch: Capgo 12.128.12 - upgrade the Capgo backend to 12.128.12 or later as described in GHSA-hqq2-87cp-j83x (https://github.com/Cap-go/capgo/security/advisories/GHSA-hqq2-87cp-j83x) and corroborated by https://www.vulncheck.com/advisories/capgo-deleted-bundle-selection-via-missing-deletion-filter-in-updates-endpoint. If an immediate upgrade is not possible, compensating controls include hard-deleting rather than soft-deleting bundles that must not be served (trade-off: loses audit trail and undo capability), unassigning soft-deleted bundles from every channel before deletion (trade-off: requires operational discipline and is easy to miss), tightening access so only a small set of trusted accounts have channel/bundle management privileges since PR:L is required (trade-off: slows release operations), and monitoring /updates responses for bundle IDs that have been marked deleted (trade-off: detection only, not prevention).
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today