Authorization Flaw in Capgo App Icon Update Path

Capgo (capgo.app) is vulnerable to an authorization flaw within the app icon update mechanism. The PUT /app/:id endpoint fails to validate that the provided 'icon' value resides within the specific app's image namespace. By submitting a path pointing to an out-of-scope storage object, an authenticated user with limited write access can influence the application's backend worker.

When the 'icon' field is updated, it triggers the 'on_app_update' event. A background worker, executing with elevated service-role credentials (supabaseAdmin()), subsequently processes this record by calling 'cleanStoredImageMetadata()'. This function performs a download and re-upload (upsert) operation on the attacker-supplied object path. Because the worker operates with administrative privileges, it bypasses Supabase Row Level Security (RLS) constraints, effectively allowing an attacker to overwrite sensitive files, such as organization logos, to which they would otherwise lack read or write permissions. This vulnerability affects all current versions of the service.

Impact

An attacker exploiting this vulnerability can perform unauthorized file overwrites within the Supabase storage backend. This can lead to the defacement of organization-level assets or potential operational disruption by replacing legitimate system images with malicious or arbitrary content, bypassing standard access controls.

Recommendation

• Monitor API access logs for PUT requests to the '/app/:id' endpoint involving suspicious or unexpected file paths in the 'icon' parameter.
• Review Supabase storage bucket permissions and audit the 'on_app_update' trigger function for any unauthorized modifications.
• Implement additional input validation on the application layer to enforce strict namespace checks for user-provided image paths before they reach the backend processing trigger.
• Monitor for unauthorized upsert operations within sensitive storage directories where organization logos or administrative assets are stored.