Capgo R2 Storage Quota Bypass via Unrestricted File Upload

Executive Summary

CVE-2026-56309 is a vulnerability in Capgo versions before 12.128.2 where the /files/upload/attachments endpoint does not properly enforce plan or quota restrictions.

This allows apps that should be blocked by their plan to still upload publicly readable attachments using upload-scoped API keys. These attachments are stored as R2 objects that are not tracked in the app's metadata, persist even after the app is deleted, and exist outside normal accounting or quota controls.

The root cause is insufficient enforcement of plan and quota checks during uploads and lack of cleanup for these orphaned attachments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to storage and bandwidth abuse because attackers can upload arbitrary attachments that are publicly readable and persist indefinitely.

Since these attachments bypass normal plan restrictions and are not cleaned up after app deletion, they can consume resources without limit, potentially increasing costs or degrading service performance.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unauthorized or unusual uploads to the /files/upload/attachments endpoint using upload-scoped API keys that bypass plan checks.

You can look for publicly readable R2 objects that are not tracked in app metadata and persist even after app deletion, indicating potential exploitation.

Suggested commands might include inspecting logs for API calls to /files/upload/attachments and querying storage buckets for orphaned or unexpected objects.

• Use network monitoring tools or log analysis to filter requests to the /files/upload/attachments endpoint.
• Run commands to list publicly readable R2 objects, for example, using the R2 CLI or API to identify objects not linked to active apps.
• Check for upload-scoped API key usage patterns that do not align with normal app behavior.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing plan and quota checks on the /files/upload/attachments endpoint to prevent unauthorized uploads.

Ensure that attachments are tracked in the database metadata and validate object ownership before serving any uploaded content.

Implement cleanup routines to remove orphaned attachments, especially those surviving app deletion.

• Upgrade Capgo to version 12.128.2 or later where the vulnerability is fixed.
• Restrict or audit the use of upload-scoped API keys to prevent abuse.
• Monitor storage usage and bandwidth to detect abnormal increases that may indicate exploitation.

Useful 0 Not Useful 0