Capgo vulnerabilities

An authorization bypass vulnerability in Capgo before version 12.128.2 allows write-scoped API keys to directly modify protected channel configuration fields via PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can alter sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.

A vulnerability in Capgo before version 12.128.2 is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, leading to preview misrouting and denial of preview access for victim applications.

A vulnerability in Capgo before version 12.128.2 in the accept_invitation endpoint creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

A vulnerability in Capgo before version 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.

A vulnerability in Capgo before version 12.128.2 discloses information via the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

The vulnerability in Capgo before version 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata.

A vulnerability in Capgo before version 12.128.2 stems from an authorization flaw in the transfer_app() function that fails to update the deploy_history.owner_org field when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.

An HTML injection vulnerability in Capgo before version 12.128.2 in the organization settings endpoint allows attackers to inject malicious HTML content. By crafting payloads in the organization name field, they can redirect users to untrusted websites, enabling phishing attacks and reputational damage.

A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.

A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to access sensitive organizational data of users via the RPC function public.get_orgs_v6. This function, defined as SECURITY DEFINER and granted to the anon role, does not verify that the user UUID matches the authenticated context.

A policy bypass vulnerability in Capgo before version 12.128.2 allows attackers with app-scoped API keys to downgrade encrypted bundles to non-encrypted state by clearing session_key and key_id fields in the app_versions table via PostgREST.

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter before enforcing privacy restrictions. This allows attackers to enumerate private channels and leak version/config state.

Capgo before version 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.

Capgo before version 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that can be called using only the public Supabase key without authentication. The endpoint is CORS-permissive and lacks rate limiting, enabling attackers to perform password spraying and credential stuffing attacks.

An information disclosure vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to enumerate organization IDs via the Supabase PostgREST SECURITY DEFINER RPC function. Different error messages (NO_ORG vs NO_RIGHTS) reveal valid organization identifiers.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read internal org_id and provider_id values via the /private/sso/check-domain endpoint. This enables mapping email domains to organization UUIDs and SSO provider identifiers, facilitating reconnaissance against Capgo tenants.

A vulnerability in Capgo before version 12.128.2 allows enterprise administrators to delete password identities of users in foreign organizations via the SSO prelink endpoint. Attackers with org.update_settings permission and an active SSO provider can permanently remove email-based authentication for any user matching the provider's email domain, forcing victims to use the attacker's SSO provider or complete password reset recovery.

A vulnerability in Capgo before version 12.128.2 allows changing the account email address without requiring current password re-authentication or verification of the existing email address. An attacker with a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

Capgo before version 12.128.2 contains a SQL injection vulnerability in the POST /private/admin_stats endpoint. The limit parameter is destructured from an unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals.

A vulnerability in Capgo before version 12.128.2 in the POST /webhooks/test endpoint allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks, bypassing the limited_to_apps authorization check.

In Capgo before version 12.128.2, a privilege escalation vulnerability exists where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to the stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read sensitive financial and operational metrics via the Supabase PostgREST global_stats endpoint. Using only the public API key, attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

Capgo before version 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. Unauthenticated attackers can call this function via the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve sensitive API key metadata including user_id, mode, org scoping, and expiration details when supplied a valid key value.

A vulnerability in Capgo before version 12.128.12 allows billing authorization bypass due to a discrepancy in the plan_valid calculation. Organizations with exhausted or expired credit grants can still access /updates, /stats, /channel_self, and attachment upload endpoints.

An authentication bypass vulnerability in Capgo before version 12.128.2 allows attackers to change user passwords without requiring current password confirmation. This flaw can be exploited by attackers with temporary session access.

An information disclosure vulnerability in Capgo before version 12.128.2 exists in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

An authorization bypass vulnerability in Capgo before version 12.128.2 allows read-only org members to insert OTA manifest rows via the public.manifest INSERT policy. Attackers with read-only access can inject malicious manifest entries with arbitrary s3_path values, which are served to devices through the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.

Capgo before version 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.

A vulnerability in Capgo before version 12.128.2 allows server-side validation bypass in organization security settings. Authenticated org admins can persist invalid security policy state by directly updating the public.orgs table from the browser.

A vulnerability in Capgo before version 12.128.2 stems from improper error handling in the /private/accept_invitation endpoint. Instead of returning safe 4xx errors, the server returns HTTP 500 when magic_invite_string is invalid, allowing attackers to leak internal processing details.

A vulnerability in Capgo before version 12.128.2 allows multiple public channels for the same app and platform to coexist, while unnamed /updates requests without a default channel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create an ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to enumerate existing organizations via the public.invite_user_to_org RPC function. Attackers can use an API key to call the SECURITY DEFINER function and determine whether an organization ID exists based on distinct error responses (NO_ORG vs NO_RIGHTS).

An authorization flaw in Capgo before version 12.128.2 in the POST /private/create_device endpoint allows an authenticated attacker to create device records for an application using a foreign organization identifier. The lack of validation of the org_id parameter bypasses the intended org/app authorization boundary.

A vulnerability in Capgo before version 12.128.2 discloses information via the /private/validate_password_compliance endpoint, which returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observing response status codes and error messages.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to use the RPC functions get_user_id and get_org_perm_for_apikey to validate API keys and disclose user UUIDs. Using the public API key, attackers can verify leaked keys, enumerate users and apps, and determine permission levels.

An authentication bypass vulnerability in Capgo before version 12.128.2 allows account deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, leading to unauthorized account deletion, data loss, and denial-of-service.

An authorization bypass vulnerability in Capgo before version 12.128.2 allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations.

A vulnerability in Capgo before version 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileged app actions.

Capgo before version 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.

The vulnerability in Capgo before version 12.128.2 is a broken object level authorization in the middlewareKey() function. It accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.

A vulnerability in Capgo console.capgo.app/login before version 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to bypass authorization in the public.get_org_user_access_rbac function. By exploiting improper NULL comparison in the authorization gate, attackers can disclose RBAC role bindings and member email addresses using only a public API key.

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures.

Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to enumerate app_ids by calling POST /rest/v1/rpc/exist_app_v2 with arbitrary appid parameters.

Capgo before version 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons.

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owner_org unchanged.

Capgo before version 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive organization management API endpoints do not validate 2FA completion on the backend, allowing an authenticated Admin user without 2FA to bypass the requirement.

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers.

Capgo versions before 12.128.2 fail to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via the x-limited-key-id header in the middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys.