CVE-2026-56250: Capgo API Key Scope Bypass Enables Bundle Deletion

Technical summary

The vulnerability stems from insufficient authorization checks on the mutable app_versions.r2_path field in PostgREST. Upload-scoped API keys—intended only for uploading new application versions—can be used to modify the r2_path pointer after creation. An attacker exploits this by: (1) uploading a malicious version under their control, (2) modifying the r2_path to reference a victim's legitimate R2 bundle object, (3) soft-deleting their own version, and (4) triggering the on_version_update cleanup function, which then deletes the victim's data assuming it is orphaned. The authorization model fails to distinguish between creation and modification contexts, and cleanup logic lacks additional validation that deleted versions' bundles actually belong to those versions before removal.

Business impact

Organizations running Capgo can experience unexpected bundle unavailability if attackers gain upload API credentials. This impacts end-user application deployments, potentially preventing users from receiving critical updates or forcing rollbacks to outdated versions. For platforms managing many applications, this creates a denial-of-service vector with reputational and operational consequences. The attack requires valid API credentials, limiting scope to supply-chain compromise or internal threats, but the impact per incident is severe.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability requires valid upload-scoped API key material, which is typically distributed to trusted CI/CD pipelines or build systems. Systems running the affected version without network isolation of API key distribution are at highest risk.

Exploitability

The attack is network-accessible and requires no user interaction, but is not unauthenticated—the attacker must possess a valid upload-scoped API key. This lowers the attack surface compared to fully remote exploits but raises it significantly above zero for organizations that manage multiple API keys across teams or pipelines. The technical barrier is low; the attacker simply needs to craft two API calls and understand the app version lifecycle. Public exploit code has not been referenced in available advisories.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch restricts API key scopes to prevent unauthorized field modification and likely adds authorization checks to the cleanup function. Organizations should simultaneously audit API key distribution, rotate any keys that may have been exposed, and review audit logs for evidence of r2_path modifications on versions not created by expected principals.

Patch guidance

Apply Capgo version 12.128.2 or later. Verify against the vendor advisory for any additional configuration changes or migration steps. If you maintain a custom Capgo deployment or fork, confirm that your update mechanism and change control processes propagate the patch to all instances. Test in a staging environment first to ensure no disruption to active deployments.

Detection guidance

Monitor PostgREST logs and Capgo application logs for: (1) API calls modifying app_versions.r2_path that originate from principals other than the version creator, (2) rapid sequences of version uploads followed immediately by soft-deletions, (3) cleanup function invocations that delete R2 objects referenced by versions not belonging to the requesting account, and (4) unexpected R2 object deletions. Implement alerting on any r2_path modification event. Review API key usage patterns to identify compromised or over-permissioned keys.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to network accessibility, absence of user interaction, and high availability impact, despite requiring authentication. Organizations with Capgo deployments that manage production application bundles should prioritize patching within their standard urgent-patch cycle. The CVSS vector reflects full availability impact (A:H) with no confidentiality or integrity loss to the Capgo system itself, only to victim bundle objects. However, the ability to delete customer data elevates business urgency.

Risk score, explained

CVSS 3.1 score 7.5 (HIGH) reflects: AV:N (network-accessible), AC:L (no complex attack conditions), PR:N (no privilege required in the Capgo system, though API authentication is required as a practical gate), UI:N (no user interaction), S:U (impact stays within the application scope), C:N (no confidentiality breach), I:N (no integrity loss to Capgo's own data), and A:H (high availability impact through data deletion). The score appropriately reflects a denial-of-service mechanism that requires valid credentials to trigger.

Frequently asked questions