Executive brief
Capgo, a platform for managing mobile app updates, contained a security flaw that allowed anyone on the internet to check if specific mobile applications were registered on the service. By sending automated requests to a public interface, an unauthorized person could map out which companies or developers use the platform. While this does not expose the app's code or user data directly, it allows for competitor reconnaissance and potential privacy violations by revealing business relationships.
Technical details
An information disclosure vulnerability exists in Capgo versions prior to 12.128.2 due to an insecurely configured RPC function. The 'public.exist_app_v2' function was defined with 'SECURITY DEFINER' privileges and granted to the 'anon' (unauthenticated) role, effectively bypassing Row Level Security (RLS) checks. Remote, unauthenticated attackers can send POST requests to the '/rest/v1/rpc/exist_app_v2' endpoint with arbitrary 'appid' parameters. The function returns a boolean value indicating whether the ID exists in the 'public.apps' table, enabling cross-tenant application enumeration. The issue was resolved in version 12.128.2 by restricting access to the function.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-03-03: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date