CVE-2026-100619

Name of the Vulnerable Software and Affected Versions Capgo (capgo.app) (affected versions not specified)

Description An indirect bypass of the row-level security policy exists in the public.manifest table. A user or principal with app-scoped upload, write, or all API keys, or an authenticated user with write+ rights, can update public.app versions.manifest for versions using the r2-direct storage provider, as these are not covered by the bundle content-lock check. The on version update async worker trusts the record.manifest and uses a service-role Supabase client to insert attacker-controlled file name, file hash, and s3 path variables into the public.manifest table. Consequently, the /updates endpoint returns this entry as a client-facing download url, allowing for Over-the-Air (OTA) manifest poisoning. OTA refers to the wireless delivery of updates to a device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.