Executive brief
Capgo, a platform for managing app updates and statistics, contained a flaw that allowed organizations to bypass billing restrictions. Users with expired or exhausted usage credits could continue to access premium features, such as delivering app updates and uploading attachments, without payment. This could lead to unauthorized service usage and loss of revenue for the service provider.
Technical details
A billing authorization bypass exists in Capgo due to a logic divergence between the plugin hot-path 'plan_valid' expression and the authoritative billing gate. The 'plan_valid' check incorrectly relies on the 'orgs.has_usage_credits' flag, which only indicates if a credit grant record exists, rather than verifying if the credits are unexpired or have a positive balance. An authenticated attacker with an exhausted or expired credit grant can exploit this to maintain access to restricted endpoints including /updates, /stats, /channel_self, and attachment uploads. The issue was addressed in version 12.128.12 by ensuring the validation logic correctly checks for available, unexpired credits.
Affected products
- Capgo Capgo < 12.128.12
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date