CVE-2026-56220 Details

An authorization bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows read-only organization members to insert rows into the public.manifest table, which stores over-the-air (OTA) update metadata. The inserted rows can include malicious entries with arbitrary S3 path values. These entries are then served to devices via the unauthenticated /updates endpoint, potentially leading to OTA metadata poisoning and the delivery of malicious assets. The issue arises from a mismatch in authorization, as the manifest insertion policy only checks for organizational membership and does not require upload or write permissions, allowing low-privileged users to modify live update metadata.

The recommended fix is to restrict the public.manifest insert and delete policies to users with upload or write permissions. Additionally, it is advised to validate that the manifest.s3_path corresponds to the correct app and version storage prefix, and to reject entries for deleted or non-live versions unless explicitly intended.