Executive brief
Capgo, a platform for managing app updates and webhooks, contains a security flaw in how it validates web addresses. An authorized administrator could configure the system to send requests to internal servers or the platform's own local network, which are normally protected from outside access. This could allow an attacker to probe internal infrastructure or gain information about private services, potentially leading to further unauthorized access.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Capgo's webhook management component due to insufficient validation of user-supplied URLs. The validation logic in 'supabase/functions/_backend/public/webhooks/post.ts' and 'put.ts' explicitly permits 'localhost' and '127.0.0.1' addresses. An authenticated organization administrator can configure a webhook to point to these internal addresses; when the webhook is triggered or tested, the backend initiates an outbound request to the specified target. Furthermore, the application returns raw connection error messages (e.g., 'Connection refused') to the user, facilitating internal network reconnaissance. The issue is resolved in version 12.128.2 by implementing stricter URL filtering.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-02-10: advisory: GitHub Security Advisory published
- 2026-06-20: disclosed: CVE published to NVD