CVE-2026-100626 in capgo.app
Summary
by MITRE • 09/26/2026
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in capgo through version 12.128.2 represents a critical insecure direct object reference (IDOR) flaw within the application's image storage management functionality. This security defect is specifically located in the PUT /app/:appId endpoint, which is designed to handle updates to application metadata including icon assets. The core technical failure lies in the server-side validation logic that fails to adequately verify whether the authenticated user requesting the update has legitimate ownership or administrative privileges over the specific appId being modified. Instead of restricting access based on identity and role-based permissions, the system relies primarily on the presence of a valid authentication token, allowing any logged-in user to interact with resources belonging to other tenants or organizations within the multi-tenant architecture.
The exploitation mechanism involves an attacker supplying arbitrary file paths in the request body that point to sensitive objects stored in the private images bucket. Because the application constructs service-role-signed URLs based on these provided paths without sufficient authorization checks, it inadvertently generates temporary access credentials for resources outside the attacker's permitted scope. These signed URLs are valid for a duration of seven days, providing a significant window of opportunity for data exfiltration. By leveraging this flaw, an authenticated but unauthorized user can retrieve cross-tenant sensitive assets such as other users' profile avatars, organizational logos, and proprietary application icons. This bypasses the intended isolation boundaries between different tenants or organizations using the platform.
From a classification perspective, this vulnerability aligns with CWE-639, which defines Insecure Direct Object References, where an application exposes internal implementation objects such as files, directories, or database keys to end users without proper access control checks. Furthermore, in terms of offensive security tactics, this behavior maps directly to the ATT&CK technique T1078, specifically Valid Accounts and potentially T1530 Data from Cloud Storage Object Buckets if the attacker proceeds to exfiltrate large volumes of data. The impact is severe as it compromises confidentiality by exposing personally identifiable information in user avatars and proprietary branding materials that may reveal internal structures or operational details of competing organizations.
Mitigation strategies must focus on implementing strict authorization checks at the application layer before processing any requests related to resource modification. Developers should ensure that every request to update an app's metadata, including icon paths, verifies that the authenticated principal is explicitly authorized as the owner or administrator of the specific appId referenced in the URL parameter. Additionally, input validation should be enforced to restrict file path inputs to a predefined whitelist of allowed directories within the storage bucket, preventing traversal attacks and access to arbitrary private objects. Implementing server-side canonicalization of paths can also help prevent directory traversal attempts that might otherwise bypass simple string matching checks. Regular security audits focusing on multi-tenant isolation logic are recommended to identify similar patterns across other endpoints in the application ecosystem.