EUVD-2026-42885
GHSA-42q8-ww2w-fgmm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L required for tenant account; S:C reflects cross-tenant impact on victim's preview environment; no confidentiality impact confirmed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim applications.
AnalysisAI
Preview namespace collision in Capgo before 12.128.2 enables authenticated low-privileged tenants to hijack or deny preview routing for other tenants' applications by deliberately registering app IDs containing double underscores that decode identically to a victim's dot-separated app ID. The non-bijective hostname parsing - where __ maps to . but . is also a valid app ID character - breaks namespace uniqueness across tenants, allowing cross-tenant preview misrouting. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; real-world impact is confined to preview functionality, not production app delivery.
Technical ContextAI
Capgo is a live-update and CI/CD platform for Capacitor (mobile hybrid app framework) applications, providing over-the-air update distribution and preview environments. Preview hostnames are constructed by encoding app IDs into subdomains, with dots replaced by double underscores. CWE-436 (Interpretation Conflict) precisely captures the root cause: the decoding function is non-bijective - double underscores (__) are decoded to dots (.), but since dots are also valid characters in app IDs, distinct inputs (com__victim__app and com.victim.app) produce the same decoded hostname. This violates the bijection requirement (one-to-one mapping) for safe namespace partitioning in multi-tenant systems. All Capgo versions before 12.128.2 are affected per CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*. The collision occurs at the hostname parsing layer, not at the authentication layer, meaning a legitimate but malicious tenant can exploit it without bypassing any access controls.
RemediationAI
Upgrade to Capgo version 12.128.2 or later, which resolves the collision by implementing a bijective encoding scheme that eliminates the ambiguity between double underscores and dots in app ID hostname construction. The vendor security advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-76qq-gg2p-pwwj contains full patch details. For self-hosted deployments that cannot immediately upgrade, a compensating control is to enforce app ID registration policies that prohibit double underscores in app IDs - this prevents attackers from registering the colliding identifiers, though it may break any legitimate existing app IDs that contain double underscores and requires auditing the current app ID registry for pre-existing collisions. Blocking new tenant registrations entirely is a more aggressive but effective stop-gap if the environment is high-risk.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today