CVE-2026-100619 Details
Description
Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.app_versions.manifest on a version whose storage_provider is 'r2-direct', which is not covered by the bundle content-lock check. The on_version_update async worker trusts record.manifest and, using the service-role Supabase client, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to the crafted version, the /updates endpoint returns the service-role-created manifest entry as a client-facing download_url, enabling OTA manifest poisoning through a trusted async worker path. All versions are affected; no patch was available at the time of publication.
A vulnerability in Capgo (capgo.app) allows for over-the-air (OTA) manifest poisoning by bypassing the restrictive row-level security policy on direct inserts to the public.manifest table. This is achieved by exploiting the public.app_versions.manifest table on versions with the 'r2-direct' storage provider, which lacks a content-lock check. A principal with an app-scoped upload/write/all API key or an authenticated user with write+ rights can manipulate the manifest data. The on_version_update asynchronous worker, trusted with service-role privileges, inserts the attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing the app_versions.manifest. When a channel is directed to the compromised version, the /updates endpoint delivers the poisoned manifest entry as a download_url, effectively allowing the manipulation of OTA updates through a trusted process.
As of the time of publication, no patch was available. However, a fix has been merged and will be included in the next production release.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-443r-w5p8-rhr2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-443r-w5p8-rhr2 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-ota-manifest-poisoning-via-app-versions-manifest-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.262.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | [email protected] |
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |