Judel777

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase/functions/ backend/utils/hono middleware.ts) accepts the JWT without validating its assurance level, and the direct RBAC path (checkPermission()/checkPermissionPg() in supabase/functions/ backend/utils/rbac.ts calling public.rbac check permission direct()) authorizes by user ID without passing or checking the session aal, unlike the public.verify mfa() control which correctly requires aal2. An attacker who knows only the victim's password can therefore authenticate, mint a persistent app-scoped app admin API key that remains valid after the aal1 session is logged out, and perform privileged operations such as modifying production OTA channel configurations (validated by changing a public production channel from bundle 1.0.0 to 1.0.1), defeating the protection provided by MFA.

Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/functions/ backend/utils/hono middleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and the authenticating key's user id, while hasLimitedRbacSubkeyScope() accepts any key with a non-organization (e.g., app-scoped) RBAC binding and validateSubkeyUser() only compares owning user IDs. Because Capgo treats API keys as independent RBAC principals with separate role bindings, an authenticated apikey manager API key with no application access can supply the numeric ID of a more privileged same-owner key and have the middleware replace the authenticated principal and effective API-key secret with that key (setSubkeyAuthContext), exercising an app admin sibling's permissions without knowing or submitting its secret. The issue was reproduced on release 12.242.4 (commit b3d02cdbc23ac59990785acacd1f113c07458568) after the fix for GHSA-8h52-44r7-w343; at the time of the advisory no patched version was available.

Capgo (capgo.app) fails to restrict direct write access to the public.sso providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce sso=true, bypassing the intended backend SSO provisioning route (supabase/functions/ backend/private/sso/providers.ts) and its controls: the Enterprise plan requirement, SSO provider creation via the Supabase Management API, DNS TXT domain-ownership verification, the pending verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports {"has sso": true, "enforce sso": true} for domains that were never verified, allowing attacker-controlled SSO enforcement to be asserted for arbitrary domains and disrupting normal login. All versions are affected; at the time of the advisory no patch was available.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the Supabase PostgREST SECURITY DEFINER RPC function `public.rescind invitation()`. Unauthenticated attackers using only a publishable API key can enumerate the existence of organizations. This is possible because the function returns distinct error messages, specifically `NO ORG` and `NO RIGHTS`, allowing attackers to identify valid organization IDs. This discovery can be used to facilitate targeted phishing or social engineering campaigns. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A cross-organization account disruption issue exists in the SSO prelink endpoint. Enterprise administrators possessing the `org.update settings` permission and an active SSO provider can utilize the `prelink-users` endpoint to permanently delete the password identities of users belonging to other organizations, provided the users match the provider's email domain. This action forces the affected users to either use the attacker's SSO provider or undergo a password reset recovery process. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the Supabase PostgREST `global stats` endpoint. Unauthenticated attackers can use the public `apikey` to query the '/rest/v1/global stats' endpoint, exposing sensitive financial and operational metrics, including Monthly Recurring Revenue (MRR), total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An issue exists where users demoted from the `super admin` role retain unauthorized access to specific functions. This occurs because the `org users.user right` column is not cleared during the deletion of role bindings, leading to stale permissions. An attacker can use this to enumerate and bulk delete non-compliant bundles across an entire organization. The affected functions are the `delete non compliant bundles` and `count non compliant bundles` RPCs. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A scope isolation issue exists in the 'POST /webhooks/test' endpoint. This flaw allows users with app-scoped API keys to execute organization-scoped webhook operations, bypassing the `limited to apps` authorization check. Consequently, an attacker using app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks that fall outside their designated app boundary. **Recommendations** Update to version 12.128.2 or later. As a temporary mitigation, restrict access to the 'POST /webhooks/test' endpoint.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.12 **Description** A billing authorization bypass exists in the `plan valid` calculation. This issue allows organizations with expired or exhausted usage credit grants to circumvent billing restrictions due to a divergence between the plugin hot-path `plan valid` expression and the authoritative billing gate. This can be exploited to maintain unauthorized access to the '/updates', '/stats', '/channel self', and attachment upload endpoints. **Recommendations** Update to version 12.128.12 or later.

**Name of the Vulnerable Software and Affected Versions** Cap-go versions prior to 12.128.2 **Description** An information disclosure issue exists in the `public.transfer app` RPC function. Unauthenticated attackers can enumerate valid app IDs by observing differences in error messages returned when calling the function using only the publishable API key, which reveals whether an app ID exists or not. **Recommendations** Update Cap-go to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the `find apikey by value()` PostgreSQL function. This function is marked as SECURITY DEFINER, which allows it to run with the privileges of the user who created it, and is executable by the `anon` role. Unauthenticated attackers can access the '/rest/v1/rpc/find apikey by value' endpoint to retrieve sensitive API key metadata, such as `user id`, `mode`, org scoping, and expiration details, by providing a valid key value. **Recommendations** Update to version 12.128.2 or later. As a temporary mitigation, restrict access to the '/rest/v1/rpc/find apikey by value' endpoint.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** Insufficient enforcement of plan and quota restrictions occurs at the '/files/upload/attachments' endpoint. This allows applications that should be blocked by their current plan to create publicly readable R2 objects (cloud storage objects). By using upload-scoped API keys, attackers can bypass plan checks to upload arbitrary attachments. These files persist independently of normal bundle metadata and remain even after an app is deleted, which can lead to storage and bandwidth abuse. **Recommendations** Update to version 12.128.2 or later. Restrict access to the '/files/upload/attachments' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An authorization bypass exists where write-scoped API keys can directly mutate protected channel configuration fields via PostgREST. This occurs due to a null authentication check in the immutability trigger, allowing attackers with write API keys to modify sensitive channel attributes such as `public`, `allow emulator`, and security-related flags outside of the intended application routes. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** Improper validation in the 'accept invitation' endpoint allows the creation of user accounts before captcha validation is enforced. This enables attackers to bypass captcha protection by sending POST requests with invalid captcha tokens, resulting in the creation of unwanted accounts and the consumption of invite links. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An issue exists due to non-bijective decoding of double underscores to dots during preview hostname parsing. This allows attackers to register app IDs containing underscores that collide with the dotted app IDs of other tenants, leading to preview misrouting and denial of preview access for victim applications. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the `get orgs v7(userid)` RPC function, which remains publicly accessible despite intended private access controls. Unauthenticated attackers can provide arbitrary user UUIDs via the `userid` variable to retrieve sensitive data of other users, including organization membership, roles, management emails, and billing metadata. **Recommendations** Update to version 12.128.2 or later. As a temporary mitigation, restrict access to the `get orgs v7(userid)` function.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the Supabase PostgREST RPC function `public.get total metrics(org id)`. This function is accessible to the anon role using only the public `sb publishable *` key. An unauthenticated attacker can verify the existence of organizations and leak sensitive usage metrics, such as Monthly Active Users (MAU), bandwidth, and install counts, by sending POST requests to the '/rest/v1/rpc/get total metrics' endpoint using valid organization UUIDs. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An authorization flaw exists in the `transfer app()` function that occurs when applications are transferred between organizations. The system fails to update the `deploy history.owner org` variable, which can allow attackers to maintain unauthorized access to deployment history records within the source organization or result in the destination organization losing access to the deployment records of the transferred application. **Recommendations** Update to version 12.128.2 or later. As a temporary mitigation, restrict the use of the `transfer app()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** The software exposes the Supabase PostgREST RPC function `public.get orgs v6(userid uuid)`, which is configured as SECURITY DEFINER and granted to the anon role, enabling unauthenticated access. The function fails to verify if the caller-supplied `userid` matches the authenticated user. An attacker with a public publishable API key can query the endpoint "POST /rest/v1/rpc/get orgs v6" using an arbitrary user UUID to retrieve sensitive personally identifiable information (PII), including organization membership, roles, subscription or trial metadata, and the management email. **Recommendations** Update to version 12.128.2 or later. Restrict access to the `public.get orgs v6()` function to prevent unauthenticated queries.