https://feed.craftedsignal.io/products/capgo--12.128.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 08 Jul 2026 14:22:30 +0000https://feed.craftedsignal.io/briefs/2026-07-capgo-r2-path-dos/Wed, 08 Jul 2026 14:22:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-capgo-r2-path-dos/A critical vulnerability, CVE-2026-56250, in Capgo before version 12.128.2 allows an authenticated attacker with upload-scoped API keys to manipulate the app_versions.r2_path field via PostgREST, leading to arbitrary R2 bundle object deletion and denial of service.Capgo, an open-source tool for managing Capacitor applications, is affected by CVE-2026-56250, a high-severity vulnerability present in versions prior to 12.128.2. This flaw enables an attacker possessing an upload-scoped API key to modify the app_versions.r2_path field through the PostgREST interface. By exploiting this, the attacker can redirect the path of an application version they control to point to arbitrary R2 bundle objects belonging to a victim. Subsequently, by initiating a "soft-delete" operation on their modified version, the attacker can trigger an internal on_version_update cleanup function that then inadvertently deletes the victim's targeted R2 object. This results in a denial of service and significant disruption to bundle availability for applications managed by the vulnerable Capgo instance, severely impacting operational integrity.

Attack Chain

1. Attacker obtains a valid upload-scoped API key for a Capgo instance, which provides legitimate access to interact with application versions.
2. Attacker identifies a target application version within Capgo that they control and a victim's critical R2 bundle object they wish to delete.
3. Attacker uses the upload-scoped API key to make a PATCH request via PostgREST, targeting the app_versions.r2_path field of their controlled application version.
4. The r2_path field is modified to point from the attacker's own R2 bundle object to the specific victim R2 bundle object, effectively retargeting it.
5. Attacker initiates an action (e.g., publishing a new version that makes the previous one obsolete) that leads to a "soft-delete" of their now-maliciously-configured application version.
6. Capgo's backend executes the on_version_update cleanup function, which follows the attacker-modified r2_path.
7. The cleanup function then erroneously attempts to "clean up" the R2 object at the retargeted path, resulting in the deletion of the victim's legitimate R2 bundle object.
8. Victim's applications that rely on the deleted R2 bundle object experience service disruption and denial of service due to unavailability of necessary resources.

Impact

The observed impact of CVE-2026-56250 exploitation is a direct denial of service (DoS) affecting applications and services managed by Capgo deployments. Attackers can leverage this vulnerability to arbitrarily delete crucial R2 bundle objects, rendering legitimate applications inoperable or unavailable. This can lead to severe operational disruptions, loss of data integrity (due to missing bundles), and potential financial and reputational damage for affected organizations. The vulnerability specifically targets the availability of application bundles, which are fundamental to the functionality of Capgo-managed applications, affecting any organization using vulnerable Capgo versions.

Recommendation

• Immediately update Capgo to version 12.128.2 or newer to remediate CVE-2026-56250.
• Review and enforce strict access control policies for all Capgo API keys, ensuring that upload-scoped keys lack permissions to modify sensitive configuration paths like app_versions.r2_path.
• Monitor Capgo application logs and PostgREST access logs for any unauthorized or unusual PATCH requests to the app_versions.r2_path field or unexpected deletion events in R2 storage.

]]>mediumadvisoryvulnerabilitydenial-of-servicecloudweb-applicationhttps://feed.craftedsignal.io/briefs/2026-07-capgo-broken-access-control/Wed, 08 Jul 2026 14:21:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-capgo-broken-access-control/Capgo versions prior to 12.128.2 contain a broken access control vulnerability (CVE-2026-56246) in their organization management API where a scoped API key inherits the full permissions of its owner-user, allowing an attacker to perform destructive operations against unauthorized organizations, bypassing intended scope and leading to privilege escalation and impact.A critical broken access control vulnerability (CVE-2026-56246) has been identified in Capgo versions prior to 12.128.2. This flaw exists within the organization management API, specifically concerning how scoped API keys (configured with limited_to_orgs) handle permissions. An attacker who gains access to an API key owned by a user who is an administrator in multiple organizations can leverage this vulnerability. The key, despite being explicitly restricted to a single organization, improperly inherits the full administrative privileges of its owner across all organizations where the owner is an admin. This bypasses the intended scope of the API key, enabling the attacker to perform unauthorized and destructive cross-organization actions, such as deleting entire organizations or removing members using endpoints like DELETE /organization and DELETE /organization/members. The root cause lies in the application's rbac_check_permission_direct logic, which evaluates the owner's global user privileges before enforcing the limited_to_orgs restriction. This allows for privilege escalation and significant unauthorized impact.

Attack Chain

1. An attacker obtains a Capgo API key belonging to a user who holds administrative privileges across multiple Capgo organizations.
2. The attacker configures or identifies an API key intended to have its operations explicitly restricted to a single, designated organization using the limited_to_orgs scope.
3. The attacker crafts an API request to perform a destructive action, such as DELETE /organization or DELETE /organization/members, targeting a different organization for which the API key is not explicitly authorized.
4. The Capgo application processes the API request, initiating an authorization check that includes a call to rbac_check_permission_direct.
5. During this authorization process, the system incorrectly evaluates the full administrative permissions of the API key's owner-user across all their assigned organizations.
6. The system fails to enforce the limited_to_orgs scope, neglecting the explicit restriction defined for the API key itself due to the flawed rbac_check_permission_direct logic.
7. The destructive API call (e.g., unauthorized organization deletion, member removal) is successfully executed against the unintended target organization, leading to unauthorized data destruction or disruption.

Impact

The successful exploitation of CVE-2026-56246 can lead to severe consequences, including unauthorized data destruction, service disruption, and privilege escalation. An attacker can leverage an improperly scoped API key to delete entire Capgo organizations or remove critical members from them, even if the key was explicitly meant for a different scope. This can cause significant operational downtime, loss of data, and potentially compromise the integrity of multiple organizational structures within Capgo, affecting all users and data associated with the targeted organizations. The broad impact stems from the ability to affect multiple, supposedly isolated, organizations via a single compromised key.

Recommendation

• Patch Capgo instances immediately to version 12.128.2 or later to address CVE-2026-56246.
• Review and re-evaluate all existing Capgo API keys, especially those with limited_to_orgs scope, to ensure they adhere to the principle of least privilege and their permissions are correctly enforced post-patch.
• Implement strict logging and monitoring for Capgo API key usage, specifically for destructive operations like DELETE /organization or DELETE /organization/members, to detect anomalous activity related to CVE-2026-56246.

]]>highadvisoryvulnerabilityprivilege-escalationdata-destructionimpactcloud