CVE-2026-56220: Capgo OTA Manifest Authorization Bypass (CVSS 6.5)

Technical summary

The vulnerability exists in the public.manifest INSERT policy of Capgo's database access layer. The policy fails to restrict manifest row insertion to authorized principals, creating a privilege escalation where read-only org members bypass the intended authorization model. Attackers exploit this by crafting INSERT statements that create OTA manifest entries with arbitrary s3_path values. The unauthenticated /updates endpoint then serves these poisoned manifests to enrolled devices without additional validation, enabling supply-chain-style attacks against the update distribution chain. The root cause is improper role-based access control (RBAC) enforcement at the database policy layer.

Business impact

Organizations using Capgo for device OTA updates face two critical business risks: (1) malicious asset delivery—attackers can redirect devices to download backdoored or tampered software, compromising the security posture of entire device fleets; (2) supply-chain trust erosion—if an organization's update infrastructure is compromised, devices will implicitly trust and install malicious updates, making incident remediation extremely difficult at scale. The attack surface extends to any downstream customer relying on Capgo-managed updates. Recovery requires identifying poisoned manifests, rolling back affected devices, and rebuilding trust in the update channel.

Affected systems

Capgo versions before 12.128.2 are affected. Organizations running Capgo for OTA update distribution should verify their installed version immediately. The vulnerability is exposable only to authenticated org members with read-only permissions or higher, meaning the attack requires some prior access to the target's organization—not an anonymous Internet-facing exposure. However, the unauthenticated /updates endpoint means the harm (malicious asset serving) reaches unauthenticated devices at scale.

Exploitability

Exploitation requires valid read-only or higher org membership, which narrows the attack surface to insider threats or compromised lower-privilege accounts. The attack complexity is low—once inside, injecting a manifest row is straightforward API usage. No user interaction or system-specific conditions are required. The impact is integrity-focused (malicious asset delivery) rather than confidentiality or availability. The CVSS 3.1 score of 6.5 (MEDIUM) reflects this: network-accessible, low complexity, low privileges required, high integrity impact, but no confidentiality or availability damage. Practical exploitation depends on having valid org credentials; however, the lack of KEV status indicates this is not yet widely exploited in the wild.

Remediation

Upgrade Capgo to version 12.128.2 or later immediately. The patch restores proper RBAC enforcement in the public.manifest INSERT policy, ensuring only authorized principals can create or modify manifest rows. Organizations should also audit OTA manifest history for suspicious entries (e.g., s3_path values pointing outside expected buckets) and verify device logs for unexpected update sources. Consider temporarily disabling OTA updates or implementing additional signing/verification of manifest metadata as a defense-in-depth measure until the patch is deployed.

Patch guidance

Update to Capgo 12.128.2 or the latest available version from your deployment channel (official repository, package manager, or vendor distribution). Verify the update is applied by checking version output (e.g., capgo --version or equivalent) on all running instances. If Capgo runs in a containerized or orchestrated environment, rebuild and redeploy container images with the patched version. Test the patched version in a staging environment against your normal OTA workflow to ensure no regressions before production rollout. No configuration changes or backwards-compatibility breaks are expected; the patch is a security hardening of the authorization layer.

Detection guidance

Monitor database audit logs for INSERT operations on the public.manifest table, especially from read-only or lower-privilege org accounts. Flag manifests with s3_path values pointing to external or unexpected S3 buckets. Review update endpoint logs for clients fetching manifests and their subsequent asset download destinations. If available, enable verbose logging on the /updates endpoint to correlate manifest queries with asset requests. Alerting on manifest modification by non-admin principals (before patching) or any manifest insertion from unexpected users can catch exploitation attempts. Post-patch, continue baselining normal manifest churn to detect reinfection or drift.

Why prioritize this

While the CVSS score is MEDIUM (6.5), this vulnerability warrants high prioritization because: (1) OTA updates are a critical supply-chain component—compromising them compromises all downstream devices; (2) the attack is subtle (poison data, not code execution) making detection and remediation harder; (3) once a manifest is poisoned, devices implicitly trust and act on it, creating a blast radius that grows with fleet size; (4) the barrier to entry is low (any read-only org member can exploit). Organizations with large device fleets or safety-critical deployments should patch within 48 hours.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) is calculated as: AV:N (network-accessible), AC:L (low complexity), PR:L (low privileges—read-only org access), UI:N (no user interaction), S:U (unchanged scope), C:N (no confidentiality), I:H (high integrity impact), A:N (no availability). The score appropriately reflects that exploitation requires some prior access (PR:L), but the integrity damage is severe and widespread (I:H). The lack of confidentiality or availability impact prevents a higher score, but organizations should treat this as high-priority despite the MEDIUM label due to the supply-chain nature of the flaw.

Frequently asked questions