EUVD-2026-43169
GHSA-x26j-344h-cfr3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated org account required (PR:L); low confidentiality and low integrity impact from unauthorized endpoint consumption including attachment uploads; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan_valid expression and the authoritative billing gate to gain continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depletion.
AnalysisAI
Billing authorization bypass in Capgo (prior to 12.128.12) enables authenticated organizations with exhausted or expired usage credit grants to continue consuming paid API endpoints without valid entitlement. The divergence between the plugin's hot-path plan_valid expression and the authoritative billing gate creates a logic gap exploitable by any organization that reaches credit depletion, granting continued access to /updates, /stats, /channel_self, and attachment upload endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this straightforward for any affected account holder to abuse.
Technical ContextAI
Capgo is an open-source over-the-air (OTA) update platform for Capacitor-based mobile applications, enabling developers to push live code changes without app-store resubmission. The vulnerability is classified as CWE-285 (Improper Authorization) and stems from a logical inconsistency in the plan_valid calculation: the expression evaluated in the plugin's hot-path diverges from the authoritative billing gate, causing the system to incorrectly treat organizations with exhausted credits as having an active plan. Affected products span all Capgo versions prior to 12.128.12, as identified by CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, covering both SaaS and self-hosted deployments running the vulnerable codebase.
RemediationAI
Upgrade Capgo to version 12.128.12 or later, which corrects the plan_valid calculation to align it with the authoritative billing gate. The GitHub Security Advisory (GHSA-g9fc-82c2-p2r6) at https://github.com/Cap-go/capgo/security/advisories/GHSA-g9fc-82c2-p2r6 is the primary reference for patch details, with additional context at https://www.vulncheck.com/advisories/capgo-billing-authorization-bypass-via-exhausted-usage-credits. For self-hosted operators unable to upgrade immediately, a compensating control would be to enforce billing-state checks at the reverse-proxy or API gateway layer for the /updates, /stats, /channel_self, and attachment upload endpoints - blocking requests from organizations with zero or negative credit balances. This requires custom billing integration and risks disrupting users within a legitimate grace period, so it should be treated as a temporary measure only until the patch can be applied.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today