Executive brief
Capgo, a platform for managing app updates and previews, contained a flaw in how it handles application identifiers. An attacker could register a specifically named application that overlaps with another customer's application preview address. This allows the attacker to disrupt the victim's operations by causing their application previews to fail or redirect incorrectly, effectively blocking them from testing or showcasing their work.
Technical details
A cross-tenant namespace collision exists in Capgo's preview routing logic due to lossy canonicalization. The preview hostname parser decodes double underscores ('__') into dots ('.') when resolving subdomains, but the application registration logic allows both characters as distinct valid inputs. An attacker with a registered account can create an app ID containing double underscores that resolves to the same preview hostname as a victim's app ID containing dots. This results in an interpretation conflict (CWE-436) where requests for the victim's preview are misrouted to the attacker's application context, leading to a denial of service for the preview functionality. The issue was addressed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date