CVE-2026-100621

Name of the Vulnerable Software and Affected Versions Capgo (capgo.app) (affected versions not specified)

Description An incomplete access-control and content-lock enforcement issue exists where the enforce encrypted bundle trigger and check encrypted bundle on insert locks exempt rows in app versions if the previous storage provider is r2-direct. This allows delivery-critical columns—including name, app id, session key, key id, storage provider, r2 path, external url, checksum, manifest, and native packages—to remain mutable. Additionally, the /updates endpoint does not exclude r2-direct versions, making them selectable for Over-the-Air (OTA) updates. An attacker with an API key possessing bundle write or upload permissions can maintain a bundle in the r2-direct state and modify these fields via PostgREST requests, resulting in altered bundle metadata being served to devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.