Executive brief
Capgo, a platform for managing app updates, contained a security flaw in how it handles application storage metrics. An unauthorized person could remotely inject false data into any customer's account using only a public access key. This could lead to corrupted dashboards, incorrect billing data, or false automated alerts, undermining the reliability of the platform's analytics.
Technical details
An authorization bypass exists in the 'public.upsert_version_meta' function within Capgo's Supabase-based backend. The function is defined with SECURITY DEFINER and is explicitly granted to the 'anon' role, but it fails to perform any ownership checks on the provided 'app_id'. By calling the PostgREST RPC endpoint with a standard public anonymous key, an attacker can insert arbitrary rows into the 'version_meta' table. This data is subsequently ingested by the metrics pipeline, leading to persistent cross-tenant metrics poisoning. The issue is resolved in version 12.128.2 by restricting function execution and adding identity verification.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-17: advisory: GitHub advisory published by Capgo
- 2026-06-20: disclosed: CVE published to NVD