Capgo.app: 19 Vulnerabilities Disclosed in Single Batch, Highlighting Authorization Flaws
Key findings • 19 vulnerabilities disclosed for Capgo.app on September 26, 2026, impacting authorization and access control. • Multiple High severity flaws found, including privilege escalati…
Key findings
- 19 vulnerabilities disclosed for Capgo.app on September 26, 2026, impacting authorization and access control.
- Multiple High severity flaws found, including privilege escalation and data integrity issues.
- Vulnerabilities affect various endpoints and features, including API key management, build uploads, and data handling.
- Some vulnerabilities, like CVE-2026-100621 and CVE-2026-100613, had no patch available at the time of disclosure.
- Affected versions range widely, with specific patches noted for some, but not all, CVEs.
On September 26, 2026, a significant batch of 19 vulnerabilities was disclosed for Capgo.app, an over-the-air update platform for Capacitor apps. These vulnerabilities, spanning authorization flaws, insecure direct object references, and incomplete access control, were all disclosed on the same day, indicating a coordinated disclosure event. The sheer volume and severity of these issues highlight potential systemic weaknesses in the platform's security posture.
Several vulnerabilities center on authorization bypasses within various API endpoints. CVE-2026-100629, for instance, details an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint where the system fails to check the rank of the role currently being bound, potentially allowing for privilege escalation. Similarly, CVE-2026-100627 points to an incorrect authorization flaw in the API-key bundle promotion path (PUT /bundle), where authorization checks are insufficient.
Insecure direct object references (IDOR) and improper access control are recurring themes. CVE-2026-100626 describes an IDOR vulnerability in the PUT /app/:appId endpoint, allowing authenticated users to access cross-tenant objects by supplying arbitrary paths. CVE-2026-100622, rated High, allows unauthenticated attackers to download deleted bundles via cached URLs due to a failure to verify deletion status. CVE-2026-100614 also involves cross-tenant issues, where a metadata-cleaning worker trusts image object keys without validating ownership.
Other critical findings include issues with API key management and data integrity. CVE-2026-100615, a High severity vulnerability, allows an apikey_manager to rotate a higher-privileged sibling key and recover its plaintext credential due to a failure to validate target API key privilege during rotation. CVE-2026-100613 highlights a flaw where principals in channel_permission_overrides are not validated to belong to the organization, enabling attackers to grant channel permissions to external users. CVE-2026-100623, a High severity bug, exposes the public.org_users table directly, with insufficient row-level security policies allowing org admins to grant excessive permissions.
The batch also includes vulnerabilities related to build processes and data handling. CVE-2026-100625 and CVE-2026-100624 both relate to the TUS upload proxy for native builds, with the former having an authorization flaw and the latter failing to enforce upload expiry or build lifecycle state. CVE-2026-100611 addresses an incomplete access-control issue affecting encrypted bundles, with no patch available at the time of publication.
The disclosed vulnerabilities affect various versions of Capgo.app, with specific versions mentioned for some fixes, such as versions before 12.127.5 for CVE-2026-100629, before 12.128.12 for CVE-2026-100628, and before 12.261.0 for CVE-2026-100612. Some vulnerabilities, like CVE-2026-100621 and CVE-2026-100613, had no patch available at the time of disclosure.
This coordinated disclosure of numerous vulnerabilities underscores the importance for Capgo.app users to review their security configurations and apply available patches promptly. The breadth of issues, from authorization bypasses to data integrity flaws, necessitates a thorough security audit and a proactive approach to patching and system hardening. Users should prioritize updates to mitigate the risks associated with these critical security flaws.