Executive brief
Capgo, a platform for managing app updates, contains a flaw in how it handles new user invitations. An attacker can bypass security CAPTCHA checks to automatically create unauthorized accounts and exhaust valid invitation links. This could lead to service disruption, the creation of unwanted 'stuck' accounts, and the exhaustion of legitimate user invites.
Technical details
An improper authentication vulnerability exists in the `accept_invitation` endpoint of Capgo. The root cause is located in `supabase/functions/_backend/private/accept_invitation.ts`, where the server invokes `supabaseAdmin.auth.admin.createUser()` before CAPTCHA enforcement is completed. CAPTCHA validation is only applied during a subsequent `signInWithPassword` call; if that call fails, the user account has already been persisted in the database. A remote, unauthenticated attacker can exploit this by sending POST requests with a valid invitation string but an invalid CAPTCHA token, leading to account creation and the 'burning' of invitation links. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo before 12.128.2
Timeline
- 2026-02-10: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date
- 2026-07-10: patched: Version 12.128.2 released