Executive brief
Capgo, a tool for managing mobile app updates, contains a flaw in how it identifies applications during the preview process. An attacker can create a specially named application that interferes with the preview functionality of other legitimate apps. This can lead to service disruptions where developers are unable to preview their work or potential confusion between different application IDs.
Technical details
The Capgo preview subdomain resolver (*.preview.capgo.app) performs application lookups using a PostgreSQL ILIKE query. Because the application ID validation allows underscores (_), which serve as single-character wildcards in SQL LIKE/ILIKE patterns, an attacker can register an application ID that matches the pattern of an existing application. The backend uses a .single() query modifier; when multiple applications match the wildcard pattern, the query fails, resulting in a Denial of Service (DoS) for the preview functionality of the legitimate application. This issue is resolved in version 12.128.2 by switching to exact equality (.eq) matches for lookups.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-20: disclosed: CVE published to NVD