Executive brief
Capgo, a service used for managing app updates and builds, contained a security flaw in how it records build activity. An unauthenticated attacker could remotely modify or create fake build logs for any organization using the platform. This could lead to fraudulent billing charges, inflated usage reports, or financial disruption by artificially increasing billable build time.
Technical details
An improper access control vulnerability exists in the SECURITY DEFINER PostgREST RPC function 'public.record_build_time' in Capgo. The function was incorrectly granted to the 'anon' role, allowing it to be called by unauthenticated users possessing only a public Supabase publishable key. Because the underlying SQL logic uses an 'ON CONFLICT (build_id, org_id) DO UPDATE' clause, an attacker can not only insert new records but also overwrite existing build and billing logs for arbitrary organizations. This allows for cross-tenant data tampering and financial-impact denial of service by inflating billable seconds. The issue is resolved in version 12.128.2.
Affected products
- Capgo capgo < 12.128.2
Timeline
- 2026-03-17: advisory: GitHub Security Advisory published by vendor
- 2026-06-19: disclosed: CVE published to NVD