CVE-2026-100619
Received Received - Intake

Capgo App OTA Manifest Injection via Async Worker

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.app_versions.manifest on a version whose storage_provider is 'r2-direct', which is not covered by the bundle content-lock check. The on_version_update async worker trusts record.manifest and, using the service-role Supabase client, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to the crafted version, the /updates endpoint returns the service-role-created manifest entry as a client-facing download_url, enabling OTA manifest poisoning through a trusted async worker path. All versions are affected; no patch was available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100619
EUVD
EUVD-2026-87714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100619 is an OTA manifest poisoning vulnerability in Capgo where an attacker with upload/write permissions can bypass security restrictions. The app blocks direct inserts into public.manifest but fails to restrict updates to public.app_versions.manifest for 'r2-direct' versions. The async worker then processes attacker-controlled manifest data, inserting malicious file metadata into public.manifest. Clients receive poisoned download URLs via the /updates endpoint.

Detection Guidance

To detect this vulnerability, inspect Capgo database tables for unauthorized modifications to public.app_versions.manifest or public.manifest. Check for unexpected file_name, file_hash, or s3_path values in these tables. Review async worker logs for on_version_update processes handling r2-direct versions. Monitor /updates endpoint responses for manifest entries pointing to unexpected URLs.

Impact Analysis

This vulnerability allows attackers to serve malicious files to users via Capgo's OTA updates. Users downloading updates may receive attacker-controlled files instead of legitimate ones, leading to potential code execution, data theft, or other malicious activities. The impact depends on the nature of the app using Capgo for updates.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and security, such as GDPR's integrity principle or HIPAA's security rule, by enabling unauthorized modification of software updates. Organizations using Capgo may face compliance risks if updates are tampered with, potentially leading to data breaches or unauthorized access.

Mitigation Strategies

Immediately revoke all app-scoped upload/write/all API keys and restrict write permissions on app_versions.manifest. Apply the fix from PR #3206 to block PostgREST writes to app_versions.manifest for r2-direct versions. Validate manifest entries in the async worker and implement stricter content-lock checks for r2-direct versions. Monitor channels pointing to affected versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart