CVE-2026-100621
Received Received - Intake

Capgo App Version Tampering via R2-Direct State

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enforce_encrypted_bundle_trigger` / `check_encrypted_bundle_on_insert` content lock in supabase/schemas/prod.sql exempts `app_versions` rows whose previous `storage_provider` is `r2-direct`, so delivery-critical columns (name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, native_packages) remain mutable while a row is in that state. Separately, the channel/version join used by the `/updates` endpoint (supabase/functions/_backend/utils/pg.ts) filters only deleted versions and does not exclude `r2-direct` versions, so such rows remain OTA-selectable. An attacker holding a Capgo API key with bundle write/upload permission can create or keep a bundle version in the `r2-direct` state, assign it to a channel, and then modify these fields via direct PostgREST requests, causing altered bundle metadata (for example checksum and session_key) to be served to devices through `/updates`. This bypasses the post-upload content immutability hardening added for a previous app_versions metadata-tampering issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100621
EUVD
EUVD-2026-87716

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo *
capgo capgo_app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100621 is a content-lock bypass vulnerability in Capgo where critical bundle metadata fields remain mutable when the storage_provider is set to 'r2-direct'. This occurs due to improper access control in database triggers and endpoint logic, allowing attackers with API key permissions to modify fields like checksums and session keys after upload. These changes are then served to devices via OTA updates.

Detection Guidance

Check for Capgo app versions with storage_provider set to 'r2-direct' using PostgREST queries. Look for mutable critical columns like checksum, session_key, or manifest in app_versions rows. Monitor /updates endpoint responses for unexpected metadata changes.

Impact Analysis

If you use Capgo for app updates, an attacker could alter bundle metadata to serve malicious versions to your users. This could lead to compromised apps, data breaches, or supply chain attacks where users receive tampered software instead of legitimate updates.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and secure software delivery. GDPR and HIPAA mandate controls to prevent unauthorized data access or tampering. The ability to modify app bundles post-upload undermines these controls, potentially exposing organizations to regulatory penalties.

Mitigation Strategies

Revoke all Capgo API keys with bundle write/upload permissions. Audit and remove any r2-direct bundle versions from channels. Temporarily disable OTA updates until a patch is available or migrate to alternative delivery methods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart