CVE-2026-100618
Received Received - Intake

Authorization Bypass in Capgo via Icon Path Manipulation

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100618
EUVD
EUVD-2026-87713

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo_app *
capgo capgo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Capgo's app icon update feature. The PUT /app/:id endpoint allows users to set an icon URL without verifying it belongs to the target app's image namespace. When updated, a privileged worker with service-role credentials processes the icon, downloading and re-uploading the referenced image. An attacker with an app-limited write API key can exploit this to make the worker modify private images outside their access scope, such as organization logos, bypassing Supabase Storage RLS restrictions.

Detection Guidance

Check Capgo application logs for suspicious PUT /app/:id requests with unusual icon paths. Monitor Supabase Storage for unexpected image modifications or re-uploads by the service-role worker. Look for events where public.apps.icon_url is updated to paths outside the app's namespace.

Impact Analysis

If you use Capgo, an attacker with an app-limited API key could modify private images like organization logos by updating an app's icon URL to point to those images. This bypasses storage restrictions and allows unauthorized changes to images you cannot directly access or modify. The impact includes data integrity issues and potential exposure of sensitive images.

Compliance Impact

This vulnerability could lead to unauthorized modification of sensitive images, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. If private images like logos or user data are altered without authorization, it may result in non-compliance with regulations mandating protection of personal and sensitive data.

Mitigation Strategies

Immediately restrict app-limited API keys to prevent unauthorized icon updates. Validate icon paths in PUT /app/:id to ensure they belong to the target app's image namespace before processing. Disable the on_app_update trigger or modify cleanStoredImageMetadata() to enforce ownership checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart