CVE-2026-100621: capgo.app Content-Lock Bypass via r2-direct Bundle Mutation
Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose previous storageprovider is r2-direct, so delivery-critical columns (name, appid, sessionkey, keyid, storageprovider, r2path, externalurl, checksum, manifest, nativepackages) remain mutable while a row is in that state. Separately, the channel/version join used by the /updates endpoint (supabase/functions/backend/utils/pg.ts) filters only deleted versions and does not exclude r2-direct versions, so such rows remain OTA-selectable. An attacker holding a Capgo API key with bundle write/upload permission can create or keep a bundle version in the r2-direct state, assign it to a channel, and then modify these fields via direct PostgREST requests, causing altered bundle metadata (for example checksum and sessionkey) to be served to devices through /updates. This bypasses the post-upload content immutability hardening added for a previous appversions metadata-tampering issue.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a Capgo API key with bundle write or upload permission. They must be able to create or retain an app_versions row using the r2-direct storage provider and assign that version to a channel.
Are devices exposed through the normal update path?
Yes. The /updates channel/version lookup excludes deleted versions but does not exclude r2-direct versions, allowing an assigned r2-direct version to remain OTA-selectable.
What can an attacker change after upload?
While the previous storage_provider is r2-direct, the content lock permits changes to delivery-critical metadata including name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, and native_packages. Modified metadata can then be served to devices through /updates.
Is a patch available?
No patch is available at the time of publication. Restrict and review Capgo API keys with bundle write or upload permission, since those permissions are required for exploitation.
How can defenders identify potentially affected versions?
Review app_versions entries using r2-direct, especially versions assigned to channels and available through /updates. Investigate changes to delivery-critical fields such as checksum, session_key, manifest, external_url, r2_path, and storage_provider after a version was uploaded.