EUVD-2026-38373Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Capgo backend host
-
DeliveryEnumerate candidate app_id values
-
ExploitSend unauthenticated GET to /functions/v1/channel_self
-
ExecutionParse channel and billing data from responses
-
PersistBuild cross-tenant target inventory
-
ImpactPivot to targeted attacks on disclosed tenants
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication, no device binding, and no user interaction are required - exploitation only needs network reachability to the Capgo backend's /functions/v1/channel_self endpoint and the ability to send HTTP GET requests with attacker-controlled app_id query parameters. The target must be a Capgo instance (SaaS at capgo.app or a self-hosted deployment) running a version prior to 12.128.2. The main limiting factor is that the attacker must guess or enumerate app_id values to discover tenants; the endpoint itself imposes no auth, rate-limit, or tenant-scope check on the request. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) accurately captures a fully remote, unauthenticated, no-user-interaction information leak with high confidentiality impact and no integrity or availability consequences - consistent with the 8.7 score. There is no public exploit identified at time of analysis, the CVE is not in CISA KEV, and no EPSS data was provided in the input, so weaponization signals are absent. Real-world impact depends on Capgo deployment scale: the primary harm is reconnaissance (tenant enumeration, billing-state oracle, internal channel name disclosure) which is high-value to a targeted attacker but unlikely to drive mass exploitation. Defenders should treat this as a credible data-exposure issue for any SaaS or self-hosted Capgo tenant, but not as an imminent RCE-class emergency. |
| Exploit ScenarioDerived | An attacker scripts unauthenticated HTTPS GET requests against https://<capgo-host>/functions/v1/channel_self?app_id=<guessed_or_wordlist_value>, iterating across plausible tenant app identifiers. Successful responses confirm which app_ids exist and reveal internal channel names (e.g., 'beta', 'enterprise-rollout') and billing/subscription state, producing a tenant inventory and a target list of paying customers. The attacker uses the harvested channel names and tenant identities to pivot into targeted social engineering, supply-chain abuse of the OTA update mechanism, or follow-on attacks against the disclosed customers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_self endpoint with arbitrary app_id values to enumerate private rollout channels, confirm the existence of tenant applications, and extract subscription/billing status. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects trivial network-level abuse against default deployments. The flaw enables cross-tenant reconnaissance that can seed further targeted attacks against high-value Capgo users.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later as published in GHSA-469v-6vw5-hxpq (https://github.com/Cap-go/capgo/security/advisories/GHSA-469v-6vw5-hxpq); this is the primary and only fully effective fix. For operators who cannot upgrade immediately, restrict network access to the /functions/v1/channel_self endpoint at a WAF or reverse proxy by requiring a valid signed device token or session JWT on every GET, and block requests where the app_id query parameter is not bound to the authenticated caller - note this requires custom logic and may break legitimate device check-ins until clients are reconfigured. Monitoring should be added for high-cardinality enumeration patterns (rapid GETs with sequential or wordlist-style app_id values from a single source IP) and unusual cross-tenant channel lookups; rate-limiting the endpoint reduces enumeration speed but does not stop a patient attacker.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is a live-update/OTA distribution platform for Capacitor mobile applications, exposing Supabase-style edge functions under /functions/v1/. The vulnerable channel_self endpoint, designed to return the calling device's assigned update channel, accepts an app_id query parameter without enforcing authentication or device-identity binding. This is a textbook CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) flaw - the endpoint trusts client-supplied identifiers and leaks back internal channel metadata (e.g., 'beta', 'staging', staged-rollout names) and billing/subscription state that should be scoped to the owning tenant. CPE coverage (cpe:2.3:a:capgo:capgo:*) shows all versions prior to 12.128.2 are affected.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Endpoint is internet-facing and unauthenticated (AV:N/PR:N), trivially scriptable (AC:L), no UI; leaks tenant/channel/billing data (C:H) without modifying or disrupting service (I:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, and leak billing status without authentication or device binding.
Executive ViewAI
Capgo deployments are vulnerable to unauthenticated reconnaissance that exposes private deployment channels, confirms customer application existence, and reveals subscription status across tenants. Attackers can map organizational infrastructure and identify high-value targets without credentials, enabling targeted follow-on attacks against Capgo customers.
No vendor-released patch identified at time of analysis. Interim mitigations: implement WAF rules to block access to /functions/v1/channel_self endpoint; apply strict rate limiting to API endpoints; restrict network access to Capgo infrastructure from untrusted networks; implement request-level authentication or IP-based access controls; monitor API access logs for enumeration patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 exposes confidential business metrics through the Supaba
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Exploit-DB