EUVD-2026-40441
GHSA-4j3c-hhjr-6vg6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires org admin privileges (PR:H) to write directly to orgs table; only low integrity impact on policy configuration, no C or A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.
AnalysisAI
Server-side validation bypass in Capgo before 12.128.2 allows authenticated organization administrators to write invalid values directly to the public.orgs database table from the browser, circumventing field-level security policy enforcement for parameters such as max_apikey_expiration_days. The root cause is insufficient server-side enforcement in a Supabase-backed architecture where authenticated clients can interact directly with underlying tables without adequate RLS or server-side validation gates. No public exploit has been identified and the vulnerability is not listed in CISA KEV, though the low-complexity attack path makes it trivially executable by any org admin.
Technical ContextAI
Capgo is a cloud-based over-the-air (OTA) update service for Capacitor and Ionic mobile applications, enabling live app updates without app store resubmission. The affected component is organization security settings stored in the public.orgs Supabase table. CWE-20 (Improper Input Validation) is the root cause class: the application architecture permits authenticated browser clients to write directly to this table without passing through server-side validation logic that enforces acceptable value ranges for security-sensitive fields. In Supabase deployments, enforcement relies on Row-Level Security (RLS) policies and server-side functions; when these controls are absent or incomplete, an authenticated client with sufficient table-write permissions can bypass application-layer constraints entirely. The specific field cited, max_apikey_expiration_days, governs how long API keys remain valid within an organization - a governance control that can be silently undermined via this bypass. The CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* covers all Capgo versions, with the vulnerability present before 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which introduces server-side enforcement for organization security settings and prevents direct client-side writes from bypassing field validation. The vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-964v-j58v-2q3h contains full patch details. As a compensating control prior to patching, administrators should audit the public.orgs table for anomalous values in security-sensitive fields - particularly max_apikey_expiration_days - and compare them against organizational policy baselines; values outside expected bounds indicate possible exploitation. Implementing or tightening Supabase Row-Level Security policies to restrict direct client writes to sensitive org fields would address the underlying architectural pattern, though this requires thorough regression testing to avoid breaking legitimate administrative workflows. Additionally, rotating API keys that may have had their expiration policy manipulated reduces residual exposure from any pre-patch abuse.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today