EUVD-2026-38374Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Capgo channel_self endpoint
-
DeliveryScript request loop rotating device_id values
-
ExploitBypass per-device rate limit
-
ExecutionInsert unbounded rows into channel_devices
-
PersistExhaust database resources
-
ImpactDeny OTA update service to legitimate clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network reachability to the Capgo channel_self endpoint of a Capgo deployment running a version earlier than 12.128.2; no authentication, no user interaction, and no non-default configuration are required because device_id is a normal client-supplied parameter on this endpoint. Limiting factors are minimal: an upstream IP-based rate limiter or WAF in front of Capgo would blunt the flood, and the impact is bounded to availability of the Capgo database tier rather than code execution or data disclosure. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects that exploitation is remote, low-complexity, and requires no authentication or user interaction, and VA:H captures the availability hit on the database tier. VI:L is reasonable because table bloat indirectly affects data integrity guarantees, while confidentiality is untouched. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure cannot be quantified - the risk is primarily availability-oriented denial of service rather than data compromise or RCE, which tempers the headline 8.8 score for organizations whose Capgo instance is not internet-exposed or sits behind an upstream WAF/rate limiter. Defenders running multi-tenant or SaaS Capgo deployments should treat this as a priority because a single attacker can degrade service for all tenants sharing the database. |
| Exploit ScenarioDerived | An attacker scripts a loop that POSTs to the Capgo channel_self endpoint while incrementing or randomizing the device_id field on each request, sending thousands of requests per second from a single host without ever tripping the per-device rate limit. Each request inserts a new row into channel_devices; within minutes the table grows large enough to degrade query performance, exhaust connection pools, or fill disk, denying OTA update service to every application relying on that Capgo instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpoint by rotating the client-supplied device_id parameter, defeating per-device throttling. Sustained abuse writes unbounded rows into the channel_devices table, exhausting database resources and degrading or denying service to legitimate users. No public exploit identified at time of analysis, but the attack is trivial to script given CVSS 4.0 AV:N/AC:L/PR:N/UI:N.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is the vendor-released patch referenced in GHSA-77p2-9rcr-5w27 (https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27). If immediate upgrade is not possible, place an upstream rate limiter (reverse proxy, CDN, or WAF such as Cloudflare or nginx limit_req) in front of the channel_self endpoint that keys throttling on source IP or authenticated identity rather than the request-body device_id - be aware this can over-throttle legitimate users behind shared NATs or carrier-grade proxies. As a defensive cleanup, periodically prune orphaned rows from the channel_devices table and monitor its growth rate and database disk usage for anomalous spikes that indicate ongoing abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Capgo is an open-source over-the-air (OTA) live-update platform for Capacitor mobile applications, backed by a PostgreSQL/Supabase database. The vulnerable channel_self endpoint identifies callers by a device_id value supplied in the request, and the rate-limit key is derived from that same untrusted identifier rather than from a server-side property such as source IP, authenticated user, or token. The CWE-770 (Allocation of Resources Without Limits or Throttling) root cause means each unique device_id is treated as a separate principal, so each new value resets the throttle and inserts another row into the channel_devices table. CPE cpe:2.3:a:capgo:capgo covers all builds before 12.128.2.
Know when Capgo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated flood against a default endpoint (AV:N/AC:L/PR:N/UI:N); availability of DB tier is the primary impact (A:H), with minor integrity from table bloat (I:L) and no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.
Executive ViewAI
Capgo versions prior to 12.128.2 contain an unauthenticated rate-limit bypass vulnerability that allows attackers to trigger denial-of-service conditions by exhausting database resources, directly impacting service availability for all users. The attack requires no authentication or special privileges and can be executed trivially at scale, creating immediate operational risk with no vendor patch currently available. Organizations running affected Capgo versions face service disruption without mitigation or upgrade options.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy application-level or reverse-proxy rate-limiting to throttle requests per device_id or source IP; (2) Monitor database query performance and alert on channel_devices table row growth exceeding normal baseline; (3) Restrict channel_self endpoint access to authorized client IP ranges if operationally feasible; (4) Implement request logging to detect device_id rotation patterns for blocking or rate-limiting; (5) Optimize database connection pool limits and query timeouts to prevent cascading failures during high-volume attacks; (6) Establish weekly checks of vendor advisory channels for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Unauthenticated information disclosure in Capgo before 12.128.2 exposes confidential business metrics through the Supaba
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Exploit-DB