Executive brief
Capgo, an app update management service, contains a flaw where app versions that have been deleted by an administrator remain available for deployment to user devices. This means that if a company deletes a buggy or sensitive app update to stop its distribution, the system may continue to send that deleted update to users. This can lead to incomplete rollbacks of bad releases and the continued exposure of potentially harmful or unauthorized app versions.
Technical details
A logic error exists in the Capgo backend's update resolution process (CWE-672). When an app owner deletes a bundle, the system sets a 'deleted' flag to true but fails to detach the bundle from existing distribution channels. The '/updates' endpoint, which handles device update requests, performs a database join between channels and app versions without checking the 'deleted' status. Consequently, if a channel still references a deleted version ID, the system will continue to serve that bundle to devices as long as the underlying storage (external URL or R2 path) remains accessible. This allows for the continued deployment of stale or revoked software versions. The issue is resolved in version 12.128.12 by ensuring the join logic filters for 'deleted = false'.
Affected products
- Capgo Capgo < 12.128.12
Timeline
- 2026-05-08: advisory: Initial GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD