Executive brief
Capgo is an application deployment and update platform that stores user and application images in cloud storage. An authenticated attacker can modify image metadata for other organizations or users by exploiting a worker service that does not verify image ownership before processing uploads. This allows silent changes to cross-tenant image metadata, potentially altering how applications or organizations appear to end users.
Technical details
A database trigger routes image updates to an internal metadata-cleaning worker that constructs a privileged Supabase client using SUPABASE_SERVICE_ROLE_KEY. The worker accepts image keys from mutable database rows without validating that the key belongs to the row's owner, allowing an authenticated user to place another tenant's known image key into a row they control. The worker then downloads, sanitizes, and re-uploads the victim's image with changed metadata bytes, bypassing storage access controls through a confused-deputy attack pattern.
Affected products
- Cap-go Capgo before 12.244.1
Timeline
- 2026-09-26: disclosed: CVE-2026-100614 and GHSA-rcrw-pg2v-j9xg published
- 2026-09-26: patched: Fixed in version 12.244.1