CVE-2026-100621 Details

A vulnerability exists in Capgo (capgo.app) due to incomplete access control and content lock enforcement, affecting all versions. The issue arises because the content lock in the application's SQL schema exempts 'app_versions' rows with a previous 'storage_provider' of 'r2-direct'. This exemption allows critical delivery columns, such as name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, and native_packages, to remain mutable while the row is in that state. Additionally, the '/updates' endpoint's channel/version join does not filter out 'r2-direct' versions, leaving them selectable for over-the-air updates. An attacker with a Capgo API key that includes bundle write/upload permissions can exploit this by creating or maintaining a bundle version in the 'r2-direct' state, assigning it to a channel, and then altering key metadata fields through direct PostgREST requests. This modified metadata, such as the checksum and session_key, is then delivered to devices via the '/updates' endpoint, circumventing the intended immutability safeguards that were implemented to address a prior metadata tampering issue.

To address this vulnerability, the content lock should be revised to include 'r2-direct' rows once they are channel-linked or have an R2 path. Additionally, the '/updates' endpoint should be modified to exclude 'r2-direct' versions, ensuring that only finalized rows are selectable for over-the-air updates.