What is the CVSS score of EUVD-2026-38102?

EUVD-2026-38102 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-38102?

Within 24 hours: Audit all API keys in use, identify which are app-limited, and review recent access logs for suspicious /functions/v1/apikey POST requests. Within 7 days: Rotate all existing app-limited API keys, restrict API key creation to administrative users only, and implement network-level blocking of the POST /functions/v1/apikey endpoint if business operations permit. Within 30 days: Deploy monitoring for suspicious API key creation patterns and prepare an upgrade plan for when Capgo releases version 12.128.2 or later.

Capgo EUVD-2026-38102

Q: Which versions of Capgo are affected by EUVD-2026-38102?

Capgo before version 12.128.2 contains a privilege escalation vulnerability in its API key management system that allows holders of low-privilege API keys to create unrestricted organization-wide…. A patch is available.

| CVE-2026-56216 HIGH

Improper Privilege Management (CWE-269)

2026-06-20 VulnCheck

GHSA-cr4w-2ppq-m3wq

Privilege Escalation Capgo

8.7

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain leaked app-limited API key
Delivery

Send POST /functions/v1/apikey with empty limits
Exploit

Receive unrestricted org-wide key
Execution

Enumerate apps and protected endpoints
Impact

Exfiltrate or tamper with OTA bundles

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires (1) a running Capgo deployment at a version below 12.128.2, and (2) possession of any valid app-limited API key for the target organization to authenticate the POST /functions/v1/apikey request. No user interaction, no admin role, no non-default configuration, and no platform-specific conditions are needed - the vulnerable endpoint is exposed in default installs. The principal limiting factor is the need for that initial scoped key; fully unauthenticated callers cannot trigger the flaw, which is consistent with the CVSS PR:L metric.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting a network-reachable, low-complexity flaw that needs only a low-privilege (app-limited) API key to produce full-confidentiality, integrity, and availability impact within an organization. KEV status is not listed and no EPSS, SSVC, or public POC data were provided in the input, so widespread opportunistic exploitation is not yet evidenced; however, because the prerequisite is merely possession of any app-limited key (which are routinely embedded in mobile clients or CI pipelines), the practical barrier is low. This is a real priority for any Capgo-hosted or self-hosted deployment because key leakage is common and the escalation path is a single API call rather than a multi-stage chain.
Exploit ScenarioDerived	An attacker who obtains an app-limited Capgo API key - for example by extracting it from a decompiled mobile binary, CI log, or a leaked .env file - issues a POST to /functions/v1/apikey with an empty limits payload. The server returns a new, unrestricted org-wide key, which the attacker then uses to enumerate all app listings, pull update bundles, and tamper with OTA deployments across the victim organization.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 20, 2026

Privilege escalation in Capgo before 12.128.2 allows holders of app-limited API keys to mint new unrestricted keys via the POST /functions/v1/apikey endpoint by submitting empty limit fields. The flaw effectively bypasses the API key scoping model, granting org-wide access to app listings and other protected resources from any compromised low-privilege key. No public exploit identified at time of analysis, but a vendor advisory (GHSA-2ff8-7h96-hwfp) and a VulnCheck writeup confirm the issue.

RemediationAI

Vendor-released patch: upgrade Capgo to 12.128.2 or later, per the GitHub Security Advisory GHSA-2ff8-7h96-hwfp (https://github.com/Cap-go/capgo/security/advisories/GHSA-2ff8-7h96-hwfp). Operators who cannot immediately update should rotate and revoke all existing app-limited API keys (since any could have been used to mint unrestricted peers), audit the apikeys table for keys with empty or null limit fields created prior to the upgrade, and restrict ingress to /functions/v1/apikey behind an authenticated proxy that rejects requests carrying app-limited tokens - recognizing this will break legitimate self-service key creation flows for scoped clients until the patch is applied.

Affected VersionsENISA

capgo 0 <12.128.2

Affected Packages

euvd capgo fix: 12.128.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Capgo is an open-source live-update and over-the-air (OTA) deployment platform for Capacitor mobile apps, exposing a Supabase-backed serverless API under /functions/v1/. The vulnerable endpoint, POST /functions/v1/apikey, generates new API keys but fails to enforce that a child key's limits remain a subset of the requesting key's limits. The root cause maps to CWE-269 (Improper Privilege Management): the server treats an empty limits object as 'no restrictions' rather than rejecting or inheriting from the caller, so a scoped (app-limited) key is allowed to author an unscoped peer. The affected CPE is cpe:2.3:a:capgo:capgo, covering all releases prior to 12.128.2.

Know when Capgo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 9.9 CRITICAL

Network endpoint, no special conditions, requires a low-privilege app-limited key (PR:L), no user interaction; scope changes from scoped key to org-wide resources (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jun 20, 2026 - 02:01 EUVD

DescriptionCVE.org

Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted keys by setting empty limits. Attackers with a compromised app-limited key can create an unrestricted key with org-wide access to resources like app listings and other protected endpoints.

Executive ViewAI

Why It Matters

Capgo before version 12.128.2 contains a privilege escalation vulnerability in its API key management system that allows holders of low-privilege API keys to create unrestricted organization-wide keys, bypassing intended access controls. Any compromised or misused app-level API key could grant attackers full organizational access to app listings and protected resources. Organizations using Capgo must immediately audit API key usage and implement emergency controls to prevent unauthorized access.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately rotate all app-limited API keys; (2) restrict API key generation to administrators only via role-based access controls; (3) implement API request logging and alerting on /functions/v1/apikey endpoint activity; (4) require secondary authentication (MFA/2FA) before any API key operations; (5) network-segment or rate-limit the /functions/v1/apikey endpoint if feasible; (6) implement API key expiration policies (e.g., 90-day rotation cycles) to limit exposure window of any undetected compromise.

Threat Intelligence Overview

EPSS Score

0.3%

Top 84% exploitable

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.