CVE-2026-100619 in Capgo
Summary
by MITRE • 09/26/2026
Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.app_versions.manifest on a version whose storage_provider is 'r2-direct', which is not covered by the bundle content-lock check. The on_version_update async worker trusts record.manifest and, using the service-role Supabase client, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to the crafted version, the /updates endpoint returns the service-role-created manifest entry as a client-facing download_url, enabling OTA manifest poisoning through a trusted async worker path. All versions are affected; no patch was available at the time of publication.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability described represents a sophisticated application logic flaw within the Capgo platform that allows for Over-The-Air (OTA) manifest poisoning. While the system implements Row-Level Security policies to restrict direct user inserts into the public.manifest table, these controls are circumvented through an indirect attack vector involving asynchronous background workers and specific storage provider configurations. The core issue lies in the trust relationship between the application version management layer and the manifest generation process. Specifically, principals possessing app-scoped API keys with upload or write permissions, as well as authenticated users with corresponding rights on a target application, can manipulate the public.app_versions table. By updating the manifest field of an app version that utilizes the r2-direct storage provider, attackers bypass bundle content-lock checks designed to prevent such tampering. This specific configuration path was not adequately covered by existing security controls, creating a gap in the integrity verification process for OTA updates.
The exploitation mechanism relies on the behavior of the on_version_update asynchronous worker. When an attacker modifies the manifest field with crafted data containing malicious file_name, file_hash, and s3_path values, this async worker processes the update using a service-role Supabase client. This elevated privilege level allows the worker to insert the attacker-controlled records directly into the public.manifest table, effectively bypassing the restrictive row-level security policies that normally prevent direct user access to this critical data store. Following the insertion of these malicious entries, the worker clears the original manifest from the app_versions record, leaving only the service-role-created entry in the main manifest table. This sequence ensures that the poisoned data persists and is readily accessible for subsequent operations without triggering immediate validation errors or permission denials associated with standard user roles.
The operational impact of this vulnerability is severe, as it enables an attacker to poison OTA updates distributed to end-users. When a distribution channel points to the compromised app version, the /updates endpoint serves the malicious manifest entry as the client-facing download_url. This allows attackers to redirect users to download modified or malicious application bundles under the guise of legitimate updates from Capgo. Since all versions are affected and no patch was available at the time of publication, this represents a critical risk to supply chain integrity within the Ionic/Capacitor ecosystem managed by Capgo. The ability to inject arbitrary file paths and hashes means attackers can potentially distribute malware, spyware, or other malicious code that appears authentic to users relying on automatic updates for security patches and feature improvements.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately validate the integrity of manifest data during asynchronous processing despite having input restrictions in place for direct interactions. It also relates to CWE-749 Exposure of Sensitive Information to an Unauthorized Actor if the poisoned manifests lead to further exploitation or data exposure. In terms of offensive security frameworks, this attack vector maps closely to MITRE ATT&CK technique T1505.003 Server Software Component: Web Shell and potentially T1195 Supply Chain Compromise, as it involves manipulating a trusted component within the software distribution pipeline to deliver malicious payloads. The use of an asynchronous worker with elevated privileges highlights issues related to CWE-269 Improper Privilege Management, where background processes operate with more authority than necessary for their specific task context without sufficient validation of input data integrity.
Mitigation strategies must focus on closing the trust gap between user-facing inputs and privileged backend operations. Immediate remediation should involve implementing strict content-locking mechanisms that apply uniformly across all storage providers, including r2-direct, to ensure manifest updates are cryptographically signed or verified against known good states before being processed by async workers. Additionally, the service-role Supabase client used in the on_version_update worker should be restricted from directly inserting into public.manifest without additional validation layers. Input sanitization and integrity checks must be enforced at multiple points in the pipeline, particularly before any privileged operations are executed. Until a patch is released, administrators should monitor for unusual manifest updates associated with r2-direct storage providers and consider disabling OTA update channels for affected applications to prevent user exposure to potentially poisoned content.