CVE-2026-100618: Capgo App Icon Update Privilege Escalation via Service-Role Worker

Published Sep 26, 2026
·
Updated

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace (e.g. org/{ownerorg}/{appid}/...). Updating apps.iconurl fires the onappupdate trigger, whose worker reads record.iconurl and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.

Affected Software

1 affected component
Capgo Capgo

Event History

Sep 26, 2026
CVE Published
via MITRE·01:22 PM
Data Sourced
via MITRE·01:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An authenticated user holding an app-limited write API key can exploit it. The key does not need direct read or write access to the targeted private storage object.

2

What access does an attacker need to modify an out-of-scope image?

The attacker needs permission to send a PUT request to /app/:id for an app and must supply an icon path that references a storage object outside that app's image namespace. The subsequent app-update worker performs the storage operation using service-role credentials.

3

What is the impact on storage objects?

The privileged worker can download and re-upload the referenced object with upsert enabled, allowing an out-of-scope private image object, such as an organization logo, to be rewritten. This bypasses the Supabase Storage RLS restrictions that would normally apply to the app-limited key.

4

Is a patched release available?

No. The advisory states that all versions are affected and that no patched version was available at the time of publication.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203