Executive brief
Capgo, a platform for managing app updates and statistics, contains a vulnerability that allows users with restricted API keys to discover the existence of other applications they are not authorized to see. By observing different error messages when requesting statistics, an attacker can confirm whether a specific application ID exists within the same account. This flaw breaks the isolation between different apps and could be used to map out a company's internal application infrastructure.
Technical details
An observable response discrepancy (CWE-203) exists in the 'GET /statistics/app/:app_id' endpoint of Capgo. The root cause is located in the RBAC logic where the system checks the owner-user's permissions before checking the specific API key's scope. This allows a request with a scoped API key to pass initial authorization but fail during the subsequent database fetch. An attacker with a valid, app-limited API key can distinguish between a nonexistent app (401 error) and a real sibling app outside their scope (500 error with PGRST116). This 'existence oracle' allows for the enumeration of application IDs across a tenant. The issue is fixed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-20: disclosed: NVD publication date