Executive brief
Capgo is a mobile app distribution and updates platform. An authenticated user with limited API permissions can trick the system into modifying private image files (like organization logos) that they should not have access to. By submitting a specially crafted image path when updating their app's icon, the user triggers a background worker that runs with elevated privileges and rewrites the private image, effectively escalating their permissions.
Technical details
The PUT /app/:id endpoint accepts an arbitrary icon path, normalizes it, and stores it in apps.icon_url without validating the path belongs to the target app's namespace. The update triggers on_app_update, a background worker running with supabaseAdmin() credentials that calls cleanStoredImageMetadata() and re-uploads the referenced storage object with upsert: true. An app-limited write API key can thus indirectly modify out-of-scope private objects (e.g., org/{owner_org}/logo) that Supabase Storage RLS would normally deny. All versions are vulnerable; no fix existed at the time of publication.
Affected products
- Capgo capgo.app all
Timeline
- 2026-09-26: disclosed: Public disclosure via GitHub Security Advisory and NVD