EUVD-2026-38125
GHSA-r945-3x7m-hrjx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint (AV:N), app-limited API key required (PR:L), only app ID existence disclosed with no integrity or availability impact (C:L/I:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.
AnalysisAI
Tenant isolation is broken in Capgo's statistics API before version 12.128.2, allowing authenticated holders of app-limited API keys to enumerate app IDs belonging to other tenants across the platform. The GET /statistics/app/:app_id endpoint returns distinct error codes depending on whether a target app exists (500 PGRST116) or is entirely nonexistent (401), creating an oracle that maps real app IDs outside the caller's authorized scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects the authenticated requirement and limited confidentiality impact.
Technical ContextAI
Capgo is a cloud-based live update platform for Capacitor (mobile) applications. The affected endpoint sits atop a PostgREST backend - confirmed by the platform-specific PGRST116 error code, which PostgREST emits when a query returns no rows. When an app-limited API key queries GET /statistics/app/:app_id for an app outside its permitted scope, PostgREST raises a PGRST116 error (surfaced as HTTP 500), whereas a query for a completely nonexistent app ID returns HTTP 401. This behavioral discrepancy is the textbook definition of CWE-203 (Observable Discrepancy): the system inadvertently reveals protected state - app existence - through divergent error channels. The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covering all releases prior to 12.128.2.
RemediationAI
Vendor-released patch: upgrade Capgo to version 12.128.2 or later, as documented in the GitHub security advisory GHSA-73p9-mprg-7r75 (https://github.com/Cap-go/capgo/security/advisories/GHSA-73p9-mprg-7r75). If immediate patching is not feasible, operators should audit and rotate app-limited API keys to reduce the pool of principals capable of invoking the vulnerable endpoint, and implement API gateway-level rate limiting on GET /statistics/app/:app_id to slow enumeration attempts - noting that rate limiting alone does not eliminate the oracle, only increases attacker effort. Monitoring API access logs for sequences of alternating 500 and 401 responses from a single API key across a wide range of app IDs can serve as a detection signal. Additional context is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/capgo-app-existence-oracle-via-get-statistics-app-app-id.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today