EUVD-2026-75410
GHSA-5rmr-6c73-3q3m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable via Capgo API/UI with low complexity, but requires a pre-existing account with a stale override (PR:L); control over production OTA versions yields high C/I/A over the affected channel.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.
AnalysisAI
Authorization bypass in Capgo (capgo.app), a live-update/OTA platform for Capacitor mobile apps, allows a de-provisioned user to retain channel-level permissions after their organization RBAC access has been revoked. Because Capgo does not clean up channel permission overrides when a user's last organization role binding is deleted, stale grants remain active - letting the former member perform privileged actions such as pushing or changing production OTA update versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker previously held a channel-specific permission override in Capgo and that this override was NOT removed when their last organization role binding was deleted - the stale override is the exact prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provider CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) rates this critical, but the PR:N (no privileges) metric is questionable: exploitation inherently requires an account that previously held a channel override, so the attacker authenticates as a known former member - this is an authorization escalation for an existing/expired principal, not a truly anonymous remote attack, which argues for PR:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor's server-side fix as described in GitHub Security Advisory GHSA-qfxq-2ch8-hjg9; the advisory does not enumerate an exact fixed release version in the provided data, so this is best characterized as a patch available per vendor advisory rather than a confirmed version number - self-hosted operators should upgrade to the latest Capgo release referenced by the advisory and cloud users should confirm with Capgo that the fix is deployed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users with Capgo channel permissions and cross-reference against current employee roster; review OTA push logs for deployments by recently de-provisioned accounts and validate legitimacy. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control in Capgo (capgo.app) lets any holder of an ordinary full API key forge a trusted SSO provider by
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Privilege escalation in the Capgo (capgo.app) backend through version 12.242.4 allows an authenticated API key holder to
Capgo's MFA enforcement is defeated by an authentication assurance level (AAL) mismatch across two distinct code paths:
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an exte
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
SQL injection in Capgo (cap-go) before 12.128.2 allows authenticated users with read-level API keys to access analytics
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today