Executive brief
Capgo, a platform for managing app updates, contains a flaw in how it handles invitation requests. An unauthorized user can send specially crafted requests to the server that cause it to crash or return detailed error messages. This could allow an attacker to learn sensitive information about the system's internal database structure or potentially disrupt service by flooding the server with these failing requests.
Technical details
The vulnerability is classified as CWE-209 (Generation of Error Message Containing Sensitive Information) within the `/private/accept_invitation` endpoint. The root cause is improper error handling when an invalid `magic_invite_string` is provided, leading to a server-side exception during JSON coercion of the `tmp_users` lookup. An unauthenticated attacker can trigger this by submitting a malformed string alongside a public API key. The resulting HTTP 500 response leaks internal implementation details, such as database table names and specific backend failure modes. Additionally, the backend logic may execute before CAPTCHA verification is fully enforced, potentially allowing for log exhaustion or minor DoS. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo before 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published by vendor
- 2026-06-30: disclosed: CVE published to NVD