Capgo EUVD-2026-38740

No special conditions - remote unauthenticated exploitation against default configurations of Capgo prior to 12.128.2, requiring only network reachability to the API key generation endpoint and the ability to manipulate the API key parameter in the generation request. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special attack requirements; the only limiting factor is that the target instance must be exposed to the attacker's network position and must be running an unpatched (pre-12.128.2) build.

Signals converge on high real-world risk: CVSS 4.0 base 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a remote, unauthenticated, low-complexity attack reachable over the network with no user interaction, and VC:H/VI:H captures total compromise of the targeted tenant's data. No EPSS, KEV, or SSVC data was provided, and no public exploit identified at time of analysis, so widespread mass exploitation is not yet documented; however, the conceptual exploit (tamper one parameter in an HTTP request) is so low-effort that defenders should not wait for KEV listing before patching. The advisory is published by both the vendor (GHSA) and VulnCheck, increasing confidence the issue is real and reproducible.

An attacker reaches the Capgo API generation endpoint over the internet, issues an unauthenticated HTTP request with an attacker-chosen value in the API key parameter, and the backend stores it as a valid key. The attacker then presents that key to protected endpoints to read or modify tenant applications, channels, and release bundles, potentially pushing malicious OTA updates to downstream mobile clients.