Executive brief
capgo.app is a mobile app distribution platform that manages application bundles and versions. The platform fails to verify whether bundles have been deleted before serving them from its edge cache, allowing unauthenticated attackers to download deleted bundles using previously cached URLs. Additionally, when the cache is hit but the object is missing from storage, the system automatically restores the deleted bundle back into storage, permanently undoing the deletion.
Technical details
The public bundle read endpoint lacks deletion status verification before serving cached responses; it only checks that the parent app exists. When a cache hit occurs and the object is missing from R2 storage, the endpoint performs a best-effort restore by writing cached bytes back to storage. An unauthenticated attacker with a cached URL can retrieve deleted bundles indefinitely until the cache expires, and the first post-deletion cache hit will resurrect the deleted object into storage via an unprotected bucket.put() operation.
Affected products
- Cap-go capgo.app through 12.129.0
Timeline
- 2026-09-26: disclosed: Public advisory published