Cross-Tenant Metadata Tampering in Capgo

Executive Summary

CVE-2026-100614 is a cross-tenant integrity vulnerability in Capgo before version 12.244.1. The metadata-cleaning worker trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload the object with sanitized metadata. This allows attackers to silently modify metadata in cross-tenant image objects by supplying known victim keys during authorized row updates, bypassing storage access controls.

Useful 0 Not Useful 0

Impact Analysis

An attacker could silently alter metadata in images belonging to other tenants without direct access to their storage. While visual pixels remain unchanged, metadata like timestamps or descriptions could be modified. The exploit requires the attacker to know an existing image key and involves manipulating rows they can update, such as profile pictures or application icons.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modification of metadata in shared image objects, potentially violating integrity requirements in GDPR or HIPAA. Unauthorized changes to metadata might affect audit trails or data provenance, though visual content remains unchanged. Organizations using Capgo should assess their exposure to ensure metadata integrity aligns with regulatory obligations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Capgo to version 12.244.1 or later to address the cross-tenant integrity vulnerability in the metadata worker. Ensure the metadata cleaner validates ownership of image object keys before processing them. Bind image keys to immutable source entity identities and enforce this at the storage boundary.

Useful 0 Not Useful 0