Executive brief
Capgo, a platform for managing over-the-air (OTA) updates, contains a flaw where users who were previously administrators retain high-level permissions even after being demoted. This allows a demoted user to continue viewing and deleting critical application bundles across an entire organization. Exploitation could lead to service disruptions, as affected devices would stop receiving necessary software updates.
Technical details
A privilege escalation vulnerability exists in Capgo versions prior to 12.128.2 due to improper authorization checks in the Role-Based Access Control (RBAC) system. When a user's 'super_admin' role binding is deleted via the API, the system fails to clear the legacy 'org_users.user_right' column in the database. Furthermore, the 'delete_non_compliant_bundles' and 'count_non_compliant_bundles' RPCs rely on this legacy column for authorization instead of the modern RBAC permission checks. An authenticated attacker with a previously held administrative role can exploit this to enumerate and bulk-delete non-compliant bundles across an organization indefinitely. The issue is resolved in version 12.128.2 by migrating the RPCs to use 'rbac_check_permission_direct()' and ensuring the demotion process correctly updates legacy columns.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: Vendor advisory published on GitHub
- 2026-07-12: disclosed: CVE published and NVD record created
- 2026-07-12: patched: Fix confirmed in version 12.128.2