Capgo vulnerabilities

The npm package `capgo` (through version 12.207.1) fails to compare the caller's role rank against the requested role in validateInvite(). A user holding only the org.invite_user permission can invite an external user as org_admin or org_billing_admin, and accepting the invitation creates the role binding while bypassing database protection triggers.

An authorization bypass vulnerability in Capgo before version 12.128.2 allows write-scoped API keys to directly modify protected channel configuration fields via PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can alter sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.

A vulnerability in Capgo before version 12.128.2 is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, leading to preview misrouting and denial of preview access for victim applications.

A vulnerability in Capgo before version 12.128.2 in the accept_invitation endpoint creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

A vulnerability in Capgo before version 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.

A vulnerability in Capgo before version 12.128.2 discloses information via the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

The vulnerability in Capgo before version 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata.

A vulnerability in Capgo before version 12.128.2 stems from an authorization flaw in the transfer_app() function that fails to update the deploy_history.owner_org field when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.

An HTML injection vulnerability in Capgo before version 12.128.2 in the organization settings endpoint allows attackers to inject malicious HTML content. By crafting payloads in the organization name field, they can redirect users to untrusted websites, enabling phishing attacks and reputational damage.

A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.

A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to access sensitive organizational data of users via the RPC function public.get_orgs_v6. This function, defined as SECURITY DEFINER and granted to the anon role, does not verify that the user UUID matches the authenticated context.

A policy bypass vulnerability in Capgo before version 12.128.2 allows attackers with app-scoped API keys to downgrade encrypted bundles to non-encrypted state by clearing session_key and key_id fields in the app_versions table via PostgREST.

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter before enforcing privacy restrictions. This allows attackers to enumerate private channels and leak version/config state.

Capgo before version 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.

Capgo before version 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that can be called using only the public Supabase key without authentication. The endpoint is CORS-permissive and lacks rate limiting, enabling attackers to perform password spraying and credential stuffing attacks.

Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route and its controls (Enterprise plan requirement, SSO provider creation via Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth). The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which reports {"has_sso": true, "enforce_sso": true} for domains that were never verified.

Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but never checks the rank of the role currently bound to the target binding, allowing an org_admin (rank 90) to demote an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75).

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app_id but omit org_id, limited_to_orgs, and expires_at resolve the target app and scope the key to it, but never add the app's owner organization to the list passed to validateExpirationAgainstOrgPolicies, allowing an authenticated organization member to create a non-expiring app-scoped API key.

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) and omits the request's channel_id. Because the omitted scope field is passed as SQL NULL, and channel-scope override evaluation is gated on p_channel_id IS NOT NULL, per-channel allow/deny overrides are never evaluated. A principal holding app-level channel.promote_bundle can promote a bundle to a channel with an explicit per-channel deny override.

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privileged builder API key. Because the forwarded suffix is never bound to the authorized job's upload_path or upload_session_key, a caller holding a valid 'all' or 'write' Capgo API key with app.build_native permission for one application can use its authorized proxy path for job A to write to the TUS upload resource of another job B, provided that resource suffix is known or exposed, corrupting that build's artifacts. All versions are affected; no patch was available at the time of advisory publication.

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. Although an upload_expires_at timestamp (one hour) and a 'pending' status are stored when a native build request is created, the upload proxy loads only app_id, owner_org, builder_job_id, and upload_path and checks only the app.build_native permission, allowing an authenticated caller to continue writing to the build upload session after expiry or after the build has moved beyond the upload phase.

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization; they do not require a pending invitation, acceptance of an invite token, or any action by the target user. As a result, an authenticated admin of an organization can INSERT or UPDATE org_users rows directly to add any existing public.users account as an active member with user_right="admin", bypassing the invitation and role-assignment workflow entirely.

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The content lock in supabase/schemas/prod.sql exempts app_versions rows whose previous storage_provider is r2-direct, leaving delivery-critical columns mutable, and the /updates endpoint does not exclude r2-direct versions, allowing an attacker with bundle write/upload permission to modify metadata and serve altered bundles to devices.

Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.app_versions.manifest on a version whose storage_provider is 'r2-direct', which is not covered by the bundle content-lock check. The on_version_update async worker trusts record.manifest and, using the service-role Supabase client, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to the crafted version, the /updates endpoint returns the service-role-created manifest entry as a client-facing download_url, enabling OTA manifest poisoning through a trusted async worker path. All versions are affected; no patch was available at the time of publication.

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin (a user holding org.update_settings) to update the entire row, including the internal billing pointer column customer_id. By sending an update directly to Supabase PostgREST, an authenticated org admin without org.update_billing can null or corrupt the organization's Stripe customer pointer, causing plan and billing checks to fail.

In Cap-go capgo.app before 12.267.1, the target API key privilege is not properly validated during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential.

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership.

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available), the transfer_app() database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in channel_permission_overrides. As a result, a user who held a channel permission override in the source organization retains it after the transfer, even without membership or RBAC binding in the destination organization.

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns, leaving provider_id (as well as metadata_url and attribute_mapping) writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from org_admin to org owner/super_admin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds org_admin in that organization. No patched version is available.

Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated user holding only apikey_manager calls POST /apikey, the only checks applied are the org.manage_apikeys permission, a fixed deny-list of assignable role names, and a priority-rank comparison, but no check verifies that the caller actually holds the permissions conferred by the role being assigned. Because the deny-list omits deploy roles and apikey_manager has priority_rank 78 higher than those roles, the rank check also passes.

The Capgo backend (through 12.242.4) does not validate parent-child delegation when processing the x-limited-key-id header. The middleware trusts the attacker-supplied key ID and can substitute the identity and secret of a more privileged key owned by the same user.

Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions. The Edge authorization path accepts a password-only Supabase aal1 session and grants RBAC permissions even when the account has a verified MFA factor that was not used for the session.

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

An information disclosure vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to enumerate organization IDs via the Supabase PostgREST SECURITY DEFINER RPC function. Different error messages (NO_ORG vs NO_RIGHTS) reveal valid organization identifiers.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read internal org_id and provider_id values via the /private/sso/check-domain endpoint. This enables mapping email domains to organization UUIDs and SSO provider identifiers, facilitating reconnaissance against Capgo tenants.

A vulnerability in Capgo before version 12.128.2 allows enterprise administrators to delete password identities of users in foreign organizations via the SSO prelink endpoint. Attackers with org.update_settings permission and an active SSO provider can permanently remove email-based authentication for any user matching the provider's email domain, forcing victims to use the attacker's SSO provider or complete password reset recovery.

A vulnerability in Capgo before version 12.128.2 allows changing the account email address without requiring current password re-authentication or verification of the existing email address. An attacker with a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

Capgo before version 12.128.2 contains a SQL injection vulnerability in the POST /private/admin_stats endpoint. The limit parameter is destructured from an unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals.

A vulnerability in Capgo before version 12.128.2 in the POST /webhooks/test endpoint allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks, bypassing the limited_to_apps authorization check.

In Capgo before version 12.128.2, a privilege escalation vulnerability exists where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to the stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read sensitive financial and operational metrics via the Supabase PostgREST global_stats endpoint. Using only the public API key, attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

Capgo before version 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. Unauthenticated attackers can call this function via the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve sensitive API key metadata including user_id, mode, org scoping, and expiration details when supplied a valid key value.

A vulnerability in Capgo before version 12.128.12 allows billing authorization bypass due to a discrepancy in the plan_valid calculation. Organizations with exhausted or expired credit grants can still access /updates, /stats, /channel_self, and attachment upload endpoints.

An authentication bypass vulnerability in Capgo before version 12.128.2 allows attackers to change user passwords without requiring current password confirmation. This flaw can be exploited by attackers with temporary session access.

An information disclosure vulnerability in Capgo before version 12.128.2 exists in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.