CVE-2026-100626

Name of the Vulnerable Software and Affected Versions capgo versions prior to 12.128.3

Description An insecure direct object reference occurs in the 'PUT /app/:appId' endpoint, which accepts attacker-controlled icon storage paths. Authenticated users can provide arbitrary paths within the private images bucket to obtain service-role-signed URLs valid for 7 days. This allows unauthorized reading of cross-tenant objects, such as user avatars, organization logos, and app icons.

Recommendations Update capgo to version 12.128.3 or later. Restrict access to the 'PUT /app/:appId' endpoint to minimize the risk of exploitation.