CVE-2026-100626: capgo through 12.128.2 IDOR via PUT /app icon endpoint
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated Capgo user with permission to call the PUT /app/:appId endpoint can exploit it. No user interaction is required.
What data could be exposed?
An attacker can request service-role-signed URLs for arbitrary objects in the private images bucket, potentially exposing cross-tenant user avatars, organization logos, and application icons. The signed URLs remain valid for 7 days.
How can teams check whether they may have been affected?
Review PUT /app/:appId requests for icon storage paths that reference objects outside the caller's authorized tenant or application scope. Also review issuance and use of 7-day signed URLs for private-images-bucket objects, particularly URLs associated with avatars, organization logos, or app icons.