Executive brief
Capgo, a platform for managing app updates, contains a flaw that allows authorized users to create an unlimited number of demo applications. By repeatedly triggering this process, a malicious user can overwhelm the system's database with excessive data. This can lead to service slowdowns for all customers, increased operational costs, and potential system crashes.
Technical details
A resource exhaustion vulnerability exists in the 'POST /app/demo' endpoint of Capgo due to a lack of rate limiting and quota enforcement. Authenticated users with 'org write' permissions can trigger the 'createDemoApp()' function, which utilizes a service-role client to perform approximately 138 database write operations across multiple tables (including apps, app_versions, and manifest) per request. This deterministic write amplification allows an attacker to bypass Row Level Security (RLS) and degrade database performance or increase storage costs. The issue is addressed in version 12.128.2 by implementing plan quotas and rate limiting.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD