Executive brief
Capgo is a mobile app deployment platform that delivers over-the-air (OTA) updates to applications. An authenticated user or API key holder with upload or write permissions can inject malicious manifest data that bypasses security restrictions, causing the platform to serve poisoned download URLs to end users. This enables attackers to distribute malicious app updates or other compromised content to all users of targeted applications.
Technical details
The vulnerability exploits a privilege escalation in Capgo's Supabase database layer. While direct inserts into public.manifest are blocked by restrictive row-level security, attackers with upload+ or write+ rights can update public.app_versions.manifest on versions with storage_provider='r2-direct', which bypasses the bundle content-lock validation. The on_version_update async worker then trusts this attacker-controlled data and inserts the file_name, file_hash, and s3_path into public.manifest using service-role privileges, after which the /updates endpoint returns these service-role-created entries to clients as legitimate download URLs.
Affected products
- Capgo capgo.app all
Timeline
- 2026-09-26: disclosed: CVE-2026-100619 published; GHSA-443r-w5p8-rhr2 advisory released