CVE-2026-100621 in Capgo
Summary
by MITRE • 09/26/2026
Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enforce_encrypted_bundle_trigger` / `check_encrypted_bundle_on_insert` content lock in supabase/schemas/prod.sql exempts `app_versions` rows whose previous `storage_provider` is `r2-direct`, so delivery-critical columns (name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, native_packages) remain mutable while a row is in that state. Separately, the channel/version join used by the `/updates` endpoint (supabase/functions/_backend/utils/pg.ts) filters only deleted versions and does not exclude `r2-direct` versions, so such rows remain OTA-selectable. An attacker holding a Capgo API key with bundle write/upload permission can create or keep a bundle version in the `r2-direct` state, assign it to a channel, and then modify these fields via direct PostgREST requests, causing altered bundle metadata (for example checksum and session_key) to be served to devices through `/updates`. This bypasses the post-upload content immutability hardening added for a previous app_versions metadata-tampering issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Capgo represents a critical failure in access control and data integrity enforcement within its backend infrastructure, specifically targeting the Supabase database schemas and API endpoints responsible for managing application bundle versions. This flaw allows an attacker with valid authentication credentials possessing bundle write or upload permissions to bypass immutability safeguards designed to prevent post-upload tampering of OTA (Over-The-Air) update bundles. The core issue stems from incomplete enforcement of content locks within the `supabase/schemas/prod.sql` file, particularly in functions named `enforce_encrypted_bundle_trigger` and `check_encrypted_bundle_on_insert`. These mechanisms are intended to lock specific rows once they have been uploaded to ensure that critical metadata remains unchanged after submission. However, a logical exception exists for rows where the previous state of the `storage_provider` column is set to `r2-direct`. This exemption creates a window during which delivery-critical columns such as name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, and native_packages remain mutable. Consequently, an attacker can exploit this gap by manipulating the state of bundle versions to retain write access even after initial upload procedures are ostensibly complete.
From a technical perspective, the exploitation vector involves leveraging the `/updates` endpoint located in `supabase/functions/_backend/utils/pg.ts`. This endpoint is responsible for determining which bundles should be served to client devices based on channel and version configurations. The filtering logic within this function checks only for deleted versions but fails to exclude those marked with the `r2-direct` storage provider type. As a result, bundle versions in this specific state remain selectable for OTA distribution despite their mutable metadata fields. An attacker can create or maintain a bundle version in the `r2-direct` state, assign it to an active channel, and then utilize direct PostgREST requests to modify sensitive attributes such as the checksum and session key. By altering these values, the attacker effectively changes the identity and integrity verification data of the update package without triggering the immutability locks that would normally prevent such modifications. This allows malicious or corrupted bundles to be distributed to end-user devices under the guise of legitimate updates.
The operational impact of this vulnerability is severe, as it directly compromises the supply chain security model for mobile applications managed through Capgo. By modifying the checksum and session key, an attacker can cause client devices to accept tampered binary packages that may contain malware or unauthorized code execution capabilities. The bypassing of post-upload content immutability hardening means that previous mitigations against metadata-tampering are rendered ineffective in this specific context. This undermines trust in the OTA update mechanism, potentially leading to widespread compromise of applications and user data across all devices receiving updates from affected channels. Since no patch is available at the time of publication, organizations relying on Capgo for their distribution infrastructure face significant risk until a fix is implemented or alternative mitigation strategies are deployed.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized modification of data due to insufficient restrictions on user actions based on roles and permissions. It also relates to CWE-697 Incorrect Comparison during Integrity Check, given that the system fails to properly validate or lock metadata after upload when specific storage provider states are present. In terms of MITRE ATT&CK framework classification, this behavior corresponds to T1053 Scheduled Task/Job, specifically in the context of scheduled tasks like cron jobs or automated update distributions being manipulated for malicious purposes, and potentially T1195 Supply Chain Compromise if the attacker injects malicious code into legitimate updates. To mitigate these risks, immediate actions should include restricting direct PostgREST access to production databases where possible, implementing stricter validation logic in the `enforce_encrypted_bundle_trigger` function to close the `r2-direct` exemption loophole, and adding explicit exclusion filters for non-standard storage providers in the `/updates` endpoint logic. Additionally, organizations should monitor for unusual metadata changes on bundle versions and consider temporary workarounds such as disabling OTA updates or restricting channel assignments until a permanent patch is released by Capgo.