CVE-2026-56302: Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
Until Capgo is upgraded, restrict network/public access to the Supabase images bucket (e.g., disable unauthenticated/public read/write) to prevent unauthenticated attackers from reading, inserting, or deleting stored app icons and leaking app/user IDs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56302?
The severity of CVE-2026-56302 is medium with a score of 6.5.
How do I fix CVE-2026-56302?
To fix CVE-2026-56302, implement row level security controls on the unsecured images bucket.
What vulnerabilities does CVE-2026-56302 expose?
CVE-2026-56302 exposes the unsecured images bucket allowing unauthenticated attackers to read, insert, and delete app icons.
How can CVE-2026-56302 impact my application?
CVE-2026-56302 can lead to the deletion of all icons and leakage of sensitive app IDs and user IDs.
Which version of Capgo is affected by CVE-2026-56302?
Capgo versions prior to 12.128.2 are affected by CVE-2026-56302.