CVE-2026-100626
Received Received - Intake

Insecure Direct Object Reference in Capgo Allowing Unauthorized File Access

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100626
EUVD
EUVD-2026-87770

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo to 12.128.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100626 is an Insecure Direct Object Reference (IDOR) vulnerability in the PUT /app/:appId endpoint of the Capgo app. Authenticated users can manipulate the icon storage path parameter to access arbitrary paths within the private images bucket. This allows generating service-role-signed URLs valid for 7 days, enabling unauthorized access to cross-tenant objects like user avatars, organization logos, and app icons.

Detection Guidance

To detect this IDOR vulnerability, monitor network traffic for PUT requests to /app/:appId endpoints with unusual icon path parameters. Check for repeated requests generating 7-day signed URLs from service-role clients. Inspect storage bucket access logs for unauthorized path traversals or cross-tenant object reads.

Impact Analysis

This vulnerability allows attackers to access sensitive data such as user avatars, organization logos, and app icons belonging to other users or organizations without authorization. It can lead to unauthorized data exposure, including Personally Identifiable Information (PII). The exploit requires minimal privileges, as any authenticated user who owns or can create an app can perform the attack.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to PII and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access may result in legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Immediately update capgo to the latest version beyond 12.128.2. Restrict the PUT /app/:appId endpoint to validate icon paths strictly within authorized storage folders. Disable service-role client usage for URL signing and implement Row-Level Security checks on storage paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100626. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart