EUVD-2026-38373Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Endpoint is internet-facing and unauthenticated (AV:N/PR:N), trivially scriptable (AC:L), no UI; leaks tenant/channel/billing data (C:H) without modifying or disrupting service (I:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, and leak billing status without authentication or device binding.
AnalysisAI
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_self endpoint with arbitrary app_id values to enumerate private rollout channels, confirm the existence of tenant applications, and extract subscription/billing status. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects trivial network-level abuse against default deployments. The flaw enables cross-tenant reconnaissance that can seed further targeted attacks against high-value Capgo users.
Technical ContextAI
Capgo is a live-update/OTA distribution platform for Capacitor mobile applications, exposing Supabase-style edge functions under /functions/v1/. The vulnerable channel_self endpoint, designed to return the calling device's assigned update channel, accepts an app_id query parameter without enforcing authentication or device-identity binding. This is a textbook CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) flaw - the endpoint trusts client-supplied identifiers and leaks back internal channel metadata (e.g., 'beta', 'staging', staged-rollout names) and billing/subscription state that should be scoped to the owning tenant. CPE coverage (cpe:2.3:a:capgo:capgo:*) shows all versions prior to 12.128.2 are affected.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later as published in GHSA-469v-6vw5-hxpq (https://github.com/Cap-go/capgo/security/advisories/GHSA-469v-6vw5-hxpq); this is the primary and only fully effective fix. For operators who cannot upgrade immediately, restrict network access to the /functions/v1/channel_self endpoint at a WAF or reverse proxy by requiring a valid signed device token or session JWT on every GET, and block requests where the app_id query parameter is not bound to the authenticated caller - note this requires custom logic and may break legitimate device check-ins until clients are reconfigured. Monitoring should be added for high-cardinality enumeration patterns (rapid GETs with sequential or wordlist-style app_id values from a single source IP) and unusual cross-tenant channel lookups; rate-limiting the endpoint reduces enumeration speed but does not stop a patient attacker.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today