CVE-2026-100614 Details
Description
Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload that object with sanitized metadata. Attackers can silently modify metadata in cross-tenant image objects by supplying known victim keys during authorized row updates, bypassing storage access controls through the confused-deputy metadata worker.
A cross-tenant integrity vulnerability has been identified in Capgo versions prior to 12.244.1. The issue arises in the metadata-cleaning worker, which improperly trusts image object keys from mutable database rows without verifying ownership. This flaw enables an authenticated attacker to manipulate a victim tenant's image metadata by exploiting authorized row updates, thereby bypassing storage access controls.
To address this vulnerability, the metadata worker should validate image keys against trusted ownership data before processing. Implementing server-side checks to ensure that only authorized keys are used can prevent unauthorized overwrites. Additionally, updating the application's database triggers to include ownership verification can help mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-rcrw-pg2v-j9xg | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-rcrw-pg2v-j9xg | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/capgo-before-12.244.1-cross-tenant-image-overwrite-via-metadata-worker | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.244.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |