EUVD-2026-42886
GHSA-648m-f972-jcc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a write-scoped API key so PR:L; network-reachable PostgREST with low complexity gives AV:N/AC:L; impact is integrity-only (I:H), no read or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.
AnalysisAI
Improper access control in Capgo before 12.128.2 lets holders of write-scoped API keys directly mutate protected channel configuration fields (such as public, allow_emulator, and security-related flags) through the PostgREST data layer, bypassing intended application route restrictions. The flaw stems from a null authentication check in the database immutability trigger, allowing a low-privileged but authenticated actor to alter integrity-sensitive delivery settings for a Capacitor live-update backend. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Technical ContextAI
Capgo is a live/over-the-air update service for Capacitor-based mobile apps, backed by a Supabase-style stack that exposes the Postgres database over HTTP via PostgREST. Channel configuration (the metadata governing which app bundles are delivered and under what conditions) is meant to be immutable from client-facing API keys and only changeable through privileged application routes. Immutability is enforced by a database trigger, but that trigger contains a null-authentication check flaw: when the auth context is null it fails open rather than closed, so requests carrying a write-scoped API key are treated as permitted. This is a classic CWE-284 Improper Access Control root cause - an authorization decision that does not correctly account for the null/unset principal case - compounded by the broad surface PostgREST exposes directly to the database. The affected component per CPE is cpe:2.3:a:capgo:capgo across all versions prior to the fix.
RemediationAI
Upgrade to Capgo 12.128.2 or later, which corrects the null authentication check in the immutability trigger - Vendor-released patch: 12.128.2, per advisory GHSA-ph9c-vwjq-pqhj (https://github.com/Cap-go/capgo/security/advisories/GHSA-ph9c-vwjq-pqhj). If immediate upgrade is not possible, rotate and re-scope existing write API keys and audit them for exposure, since any leaked or over-broad write key can trigger the bypass; additionally, restrict direct PostgREST access to the affected channel tables at the network or role level and tighten the database trigger/row-level-security policy so that a null auth context is denied rather than allowed. Review channel configuration history for unexpected changes to the public, allow_emulator, and related security flags and revert any unauthorized modifications. Note the trade-off: restricting PostgREST access or narrowing key scopes may break integrations that legitimately rely on write keys, so validate application routes before enforcing.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today