Executive brief
Cap-go, a platform for managing app updates, contained a flaw in how it handled requests to transfer applications between organizations. An unauthorized person could use this flaw to guess and confirm the existence of private application IDs by observing different error messages returned by the system. This could allow an attacker to map out valid application and tenant IDs, which could be used to plan more targeted attacks or leak sensitive business metadata.
Technical details
An information disclosure vulnerability (CWE-203) exists in Cap-go versions prior to 12.128.2 due to an observable discrepancy in the 'public.transfer_app' RPC function. The function was incorrectly granted execution permissions to unauthenticated ('anon') users and was defined with 'SECURITY DEFINER' privileges. When called with only a publishable API key, the function returns 'App not found' for non-existent IDs but 'You are not authorized...' for existing IDs. This allows a remote, unauthenticated attacker to perform an automated enumeration of valid application IDs. The issue was resolved in version 12.128.2 by revoking public execution permissions and ensuring uniform error responses.
Affected products
- Cap-go capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date