Executive brief
Capgo, an over-the-air (OTA) update service for mobile applications, contained a vulnerability that allowed users with limited upload permissions to delete files belonging to other versions or users. By manipulating internal file paths, an attacker could trick the system's automated cleanup process into removing legitimate application update bundles. This results in a denial-of-service condition where users are unable to download necessary app updates, potentially disrupting business operations and application availability.
Technical details
A missing authorization vulnerability (CWE-862) in Capgo's Supabase PostgREST configuration allowed upload-scoped API keys to modify the 'r2_path' field in the 'app_versions' table. While this field is intended to be server-derived, the 'Allow update for api keys' policy failed to restrict modification of this specific column. An attacker can create a version row, patch its 'r2_path' to point to a victim's R2 bundle object, and then perform a soft-delete on their own version. This triggers the 'on_version_update' cleanup function, which executes 's3.deleteObject()' on the attacker-supplied path, leading to arbitrary object deletion in the R2 bucket. The issue is fixed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: NVD publication date