EUVD-2026-38374Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated flood against a default endpoint (AV:N/AC:L/PR:N/UI:N); availability of DB tier is the primary impact (A:H), with minor integrity from table bloat (I:L) and no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.
AnalysisAI
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpoint by rotating the client-supplied device_id parameter, defeating per-device throttling. Sustained abuse writes unbounded rows into the channel_devices table, exhausting database resources and degrading or denying service to legitimate users. No public exploit identified at time of analysis, but the attack is trivial to script given CVSS 4.0 AV:N/AC:L/PR:N/UI:N.
Technical ContextAI
Capgo is an open-source over-the-air (OTA) live-update platform for Capacitor mobile applications, backed by a PostgreSQL/Supabase database. The vulnerable channel_self endpoint identifies callers by a device_id value supplied in the request, and the rate-limit key is derived from that same untrusted identifier rather than from a server-side property such as source IP, authenticated user, or token. The CWE-770 (Allocation of Resources Without Limits or Throttling) root cause means each unique device_id is treated as a separate principal, so each new value resets the throttle and inserts another row into the channel_devices table. CPE cpe:2.3:a:capgo:capgo covers all builds before 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which is the vendor-released patch referenced in GHSA-77p2-9rcr-5w27 (https://github.com/Cap-go/capgo/security/advisories/GHSA-77p2-9rcr-5w27). If immediate upgrade is not possible, place an upstream rate limiter (reverse proxy, CDN, or WAF such as Cloudflare or nginx limit_req) in front of the channel_self endpoint that keys throttling on source IP or authenticated identity rather than the request-body device_id - be aware this can over-throttle legitimate users behind shared NATs or carrier-grade proxies. As a defensive cleanup, periodically prune orphaned rows from the channel_devices table and monitor its growth rate and database disk usage for anomalous spikes that indicate ongoing abuse.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrow
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today