CVE-2026-100618: Capgo App Icon Update Privilege Escalation via Service-Role Worker
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace (e.g. org/{ownerorg}/{appid}/...). Updating apps.iconurl fires the onappupdate trigger, whose worker reads record.iconurl and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user holding an app-limited write API key can exploit it. The key does not need direct read or write access to the targeted private storage object.
What access does an attacker need to modify an out-of-scope image?
The attacker needs permission to send a PUT request to /app/:id for an app and must supply an icon path that references a storage object outside that app's image namespace. The subsequent app-update worker performs the storage operation using service-role credentials.
What is the impact on storage objects?
The privileged worker can download and re-upload the referenced object with upsert enabled, allowing an out-of-scope private image object, such as an organization logo, to be rewritten. This bypasses the Supabase Storage RLS restrictions that would normally apply to the app-limited key.
Is a patched release available?
No. The advisory states that all versions are affected and that no patched version was available at the time of publication.