Executive brief
Capgo, a platform for managing app updates, contained a security flaw where organization administrators could bypass standard security rules. By interacting directly with the underlying database from their browser, an administrator could save invalid security settings that the main system is designed to block. This could lead to weakened security policies, such as setting API keys that never expire or disabling mandatory encryption, potentially leaving the organization's data less protected than intended.
Technical details
A server-side validation bypass exists in Capgo versions prior to 12.128.2 due to inconsistent enforcement between two write paths. While the official backend API (/organization) correctly validates security-sensitive fields, the dashboard allows direct browser-side updates to the 'public.orgs' table via Supabase REST endpoints. Because the database update policies are admin-scoped but lack field-level validation, an authenticated organization administrator can bypass checks for parameters like 'max_apikey_expiration_days', 'enforce_hashed_api_keys', and 'enforce_encrypted_bundles'. This allows the persistence of forbidden security states, such as negative expiration values or disabled encryption requirements. The issue was addressed in version 12.128.2.
Affected products
- Capgo Capgo before 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date
- 2026-06-30: patched: Fix confirmed in version 12.128.2