Capgo EUVD-2026-87709

Requires an authenticated Capgo tenant account (PR:L) that can perform authorized updates to database rows containing an image object-key field, plus knowledge of a target victim tenant's image object key. The confused-deputy trigger is the metadata-cleaning worker, which runs with a service role and downloads/re-uploads objects referenced by mutable row values without validating that the requesting tenant owns the referenced key. Exploitation is limited to modifying image object METADATA cross-tenant (integrity impact); it does not disclose object contents or delete objects, and it depends on the platform running an affected version before 12.244.1 with the metadata worker enabled.

The vendor CVSS 4.0 vector (8.7, VC:H/VI:H/VA:H) rates this as high-severity full-CIA compromise, but the description contradicts that impact profile: this is a confused-deputy cross-tenant INTEGRITY flaw where a service-role metadata worker re-uploads a victim's image object with sanitized metadata. There is no described confidentiality read (the attacker does not obtain the object's contents) and no availability loss (the object is re-uploaded, not destroyed), so VC:H and VA:H appear substantially inflated - the realistic impact is bounded metadata modification of another tenant's object (integrity only, and limited in scope). The exploitability signals are genuine: CVSS 4.0 confirms AV:N/AC:L/PR:L/UI:N, meaning a low-privileged authenticated tenant can trigger it remotely with no user interaction against default behavior. There is no public exploit identified at time of analysis, no EPSS score provided, and no CISA KEV listing - no evidence of active or automated exploitation. Net: a real, low-friction authorization defect worth patching, but the raw 8.7 overstates true business risk; treat as a medium-severity cross-tenant integrity issue rather than a critical full-compromise bug.

An authenticated tenant of the Capgo platform creates or updates a database row they legitimately control (e.g. an app/version record) and inserts a known image object key belonging to a victim tenant into the image-key field. The metadata-cleaning worker, running with a service role that ignores tenant ownership, then downloads that victim object and re-uploads it with sanitized metadata, silently altering the victim's stored image. No public exploit code is identified, but the attack requires only ordinary authorized row updates plus knowledge of a victim's object key.