CVE-2026-100614

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.244.1

Description A cross-tenant integrity issue exists in the metadata-cleaning worker. The worker trusts image object keys from mutable database rows without validating ownership, acting as a confused deputy. An authenticated attacker can insert a victim tenant's image key into a row they control. This triggers the service-role worker to download and re-upload the object with sanitized metadata, allowing the attacker to silently modify metadata in cross-tenant image objects and bypass storage access controls during authorized row updates.

Recommendations Update Capgo to version 12.244.1 or later.