EUVD-2026-42246
GHSA-4pg3-prvr-6562
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requiring a valid app-scoped key (PR:L); impact is limited to integrity of encryption metadata fields with no confidentiality or availability consequence.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions table via PostgREST to clear session_key and key_id fields, bypassing organization-enforced encrypted-bundle policies and weakening OTA security controls.
AnalysisAI
Policy bypass in Capgo's OTA update enforcement allows holders of app-scoped API keys to downgrade encrypted app bundles to an unencrypted state by directly manipulating the app_versions table through PostgREST. Affected versions are all Capgo releases prior to 12.128.2. An attacker in possession of an app-scoped 'all' API key can nullify organization-level encrypted-bundle policies, silently stripping the cryptographic protections applied to over-the-air mobile updates and enabling distribution of unencrypted bundles to end-user devices. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
Capgo is a live over-the-air (OTA) update platform for Capacitor-based mobile applications, built atop Supabase and exposing its database layer via PostgREST - a REST API that translates HTTP requests directly into PostgreSQL operations. The app_versions table stores metadata governing how update bundles are delivered, including session_key and key_id fields that enforce encrypted-bundle delivery. CWE-284 (Improper Access Control) describes the root cause: the authorization logic governing write access to the app_versions table via PostgREST does not enforce column-level restrictions on security-sensitive fields (session_key, key_id) for app-scoped API key holders. Because PostgREST row-level and column-level policies were insufficiently scoped for this credential tier, an app-scoped key - intended for narrower operational use - can issue PATCH or UPDATE operations that clear the encryption metadata, effectively toggling the bundle's encryption status without triggering the organization-wide policy gate.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves this policy enforcement gap. The fix is confirmed by the vendor security advisory GHSA-4qwf-mrgx-mvfx at https://github.com/Cap-go/capgo/security/advisories/GHSA-4qwf-mrgx-mvfx. If immediate upgrade is not possible, a compensating control is to audit and revoke any app-scoped API keys granted 'all' permissions and replace them with narrower-scoped keys that do not have write access to the app_versions table. Additionally, applying PostgREST column-level security policies in the Supabase configuration to explicitly deny writes to session_key and key_id for app-scoped roles can block the bypass path without requiring an application upgrade, though this requires direct database policy modification and should be tested carefully to avoid disrupting legitimate update delivery workflows.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today