EUVD-2026-38372Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth required (PR:N), but handler blocks data exposure today so C:L reflects only latent confidentiality risk; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST and DELETE role_bindings routes, so unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs; the flaw is inconsistent authentication enforcement across HTTP methods that could enable authorization bypass if the handler logic changes.
AnalysisAI
Capgo's Supabase edge function backend (versions before 12.128.2) inconsistently applies global authentication middleware across HTTP methods on the /private/role_bindings/:org_id endpoint - GET requests reach the handler unauthenticated while POST and DELETE are gated by middleware. The handler currently performs its own authorization check and rejects unauthenticated callers, so no data is exposed in the current implementation. This is a CWE-306 defense-in-depth failure: the middleware gap creates latent risk that any future relaxation of handler-level logic could silently permit unauthenticated access to organization role binding data, with no public exploit identified at time of analysis.
Technical ContextAI
Capgo is a live-update platform for Capacitor mobile applications, using Supabase edge functions as its serverless backend. The /private/role_bindings/:org_id endpoint manages role assignment data scoped to organizations. The affected codebase (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*) uses a global authentication middleware that is selectively registered per HTTP method - POST and DELETE share the middleware, but GET does not. This results in CWE-306 (Missing Authentication for Critical Function): unauthenticated network requests to the GET route traverse the handler directly without being challenged at the middleware layer. The handler's own authorization logic currently compensates, but this is a single point of enforcement rather than layered defense, violating the principle of defense-in-depth in a serverless routing context.
RemediationAI
Upgrade Capgo backend to version 12.128.2 or later, which applies the global authentication middleware consistently to the GET /private/role_bindings/:org_id endpoint, matching the protection already in place for POST and DELETE. Details are available at the vendor advisory https://github.com/Cap-go/capgo/security/advisories/GHSA-6c9f-9v99-26ww. If immediate upgrade is not possible, operators can restrict network access to the /private/role_bindings/ path at the API gateway or reverse proxy layer to prevent unauthenticated external requests from reaching the endpoint - this compensates for the missing middleware but does not fix the root cause. Because the handler currently blocks unauthenticated responses itself, the practical window of exposure is narrow, but the compensating control eliminates dependence on handler-level logic remaining intact.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today