EUVD-2026-40442
GHSA-wx33-g984-7g82
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low-complexity; PR:L because valid API key required; integrity-only impact, no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.
AnalysisAI
Missing UPDATE row-level security (RLS) policy on Capgo's build_requests table permits low-privileged API-key holders to perform unauthorized status updates against build pipeline records, corrupting build state by leaving rows permanently stuck in a pending state with null last_error values. Capgo versions before 12.128.2 on all platforms are affected. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, exploitation requires only low-privilege network access with no additional complexity, making it a straightforward post-authentication integrity issue.
Technical ContextAI
Capgo is a live-update and CI/CD deployment platform for Capacitor mobile apps, built on Supabase which uses PostgreSQL with row-level security (RLS). RLS policies in PostgreSQL enforce per-row access control for SELECT, INSERT, UPDATE, and DELETE operations independently. When RLS is enabled on a table but no UPDATE policy is defined, the default deny-all behavior blocks all UPDATE operations - including those from legitimate builder services using API keys. The affected component is the build_requests table (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*). CWE-284 (Improper Access Control) identifies the root cause as a missing authorization control for a specific database operation, where the absence of an UPDATE RLS policy means the access control boundary for build status writes is not enforced as intended - either permitting unauthorized actors to write status updates or blocking legitimate builders from doing so, both of which corrupt the integrity of the build pipeline state.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which introduces the missing UPDATE RLS policy on the build_requests table. This is a database schema change deployed by Capgo and the upgrade path should be followed per the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-gc46-h5j6-qp6q. If immediate upgrade is not possible, a compensating control is to manually apply an UPDATE RLS policy to the build_requests table in your Supabase project, restricting UPDATE operations to only the service-role or builder-specific roles; this requires database access and should be coordinated with Capgo's schema expectations to avoid breaking the build pipeline further. Additionally, audit and rotate any API keys that have had access to the build_requests table, as the 'Authentication Bypass' tag suggests API-key holders may have had broader update access than intended. Restricting API key permissions at the Supabase role level to read-only for build_requests is a further compensating control, though it may prevent legitimate builder updates until the patch is applied.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today