CVE-2026-56250: Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions
Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable appversions.r2path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2path to point to victim objects, soft-delete the attacker-controlled version, and trigger the onversionupdate cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Prevent upload-scoped API keys from modifying the mutable app_versions.r2_path field (e.g., make r2_path immutable or strictly validate allowed retargeting paths/objects at the PostgREST layer).
Capgo app_versions.r2_path = immutable/validated - Compensating control
As a temporary mitigation, restrict PostgREST access for upload-scoped API keys so they cannot update app_versions via PostgREST (limit to only the minimal endpoints/fields required).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56250?
The severity of CVE-2026-56250 is rated high with a score of 8.7.
How do I fix CVE-2026-56250?
To fix CVE-2026-56250, upgrade to Capgo version 12.128.2 or later.
What does CVE-2026-56250 exploit?
CVE-2026-56250 exploits the mutable r2_path field in app_versions allowing attackers to target arbitrary R2 bundle objects.
Who is affected by CVE-2026-56250?
CVE-2026-56250 affects users of Capgo before version 12.128.2 who utilize upload-scoped API keys.
What type of attack is associated with CVE-2026-56250?
CVE-2026-56250 is associated with arbitrary R2 object deletion attacks through manipulation of the r2_path attribute.