Executive brief
Capgo, a platform for managing app updates and telemetry, contains a security flaw in how it handles device registration. An authorized user can bypass security boundaries to create device records for applications belonging to different organizations by providing a mismatched organization identifier. This could lead to unauthorized data injection, potentially affecting the accuracy of app analytics, auditing, or billing information.
Technical details
An authorization bypass exists in the POST /private/create_device endpoint of Capgo due to improper validation of the 'org_id' parameter. The application accepts a caller-supplied 'org_id' without verifying that it matches the 'owner_org' associated with the provided 'app_id'. While the system performs an initial authorization check, it fails to enforce the organizational boundary during the record persistence phase. An authenticated attacker can exploit this to inject device records into the telemetry of a target application they do not own. The issue was addressed in version 12.128.2 by ensuring the organization identifier matches the application's actual owner.
Affected products
- Capgo Capgo before 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date