CVE-2026-56309: Capgo Plan Restriction Bypass on File Upload Endpoint

Technical summary

CVE-2026-56309 exploits improper authorization on Capgo's /files/upload/attachments endpoint. The vulnerability allows authenticated users holding upload-scoped API keys to circumvent plan-based quota enforcement and create publicly readable objects in Cloudflare R2 storage. Uploaded attachments bypass the normal bundle metadata tracking system and persist independently of their originating application lifecycle. The root cause is the endpoint's failure to validate whether the requesting account's subscription tier permits file upload operations before accepting and storing the attachment.

Business impact

For Capgo users, this represents a service quality and cost issue. Malicious or misconfigured clients can consume disproportionate storage and bandwidth resources, inflating Capgo's hosting costs and potentially degrading service for legitimate users. For enterprises deploying Capgo, unauthorized file uploads using compromised or overprivileged API keys could lead to unexpected storage bills or serve as a vector for data exfiltration if an attacker gains API key access. Reputationally, uncontrolled storage abuse undermines Capgo's ability to enforce fair-use policies across its user base.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability is specific to the /files/upload/attachments endpoint and impacts any Capgo instance where upload-scoped API keys are issued to applications or users. Organizations using Capgo for mobile app backend services should assess whether their deployment and key management practices expose them to this risk.

Exploitability

Exploitation requires valid API credentials with upload scope—a low barrier for attackers who gain access to compromised keys, but still a requirement that prevents unauthenticated abuse. The attack is straightforward: use a standard upload API call against an endpoint that fails to validate plan restrictions. No complex payload construction or timing is required. The CVSS score of 5.4 (Medium) reflects the need for authentication but acknowledges the ease of abuse once that credential is obtained.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch restores plan-based authorization checks on the /files/upload/attachments endpoint, ensuring that only accounts with an appropriate subscription tier can upload attachments. Verify the patch release notes to confirm the specific fix aligns with your deployment model.

Patch guidance

Apply the 12.128.2 update as soon as feasible. If immediate patching is not possible, review API key scope assignments and rotate any upload-scoped keys that may have been shared or exposed. Consider implementing additional API rate limiting or IP allowlisting on the upload endpoint as a temporary compensating control while you prepare the upgrade. Test the patch in a non-production environment first to rule out compatibility issues with custom integrations.

Detection guidance

Monitor logs for unusual file uploads to the /files/upload/attachments endpoint, particularly from API keys or accounts that do not match expected usage patterns. Flag uploads originating from accounts on lower-tier plans or from unexpected geographic regions. Alert on a spike in attachment creation followed by app deletion, as this behavior is consistent with the persistence and evasion characteristics described in the vulnerability. If available, track the public readability status of uploaded R2 objects to identify artifacts that should have been access-restricted.

Why prioritize this

Although the CVSS score is moderate, the vulnerability enables resource abuse and potential cost overruns for SaaS operators. Prioritize patching based on your organization's reliance on Capgo, the sensitivity of API key management in your environment, and whether you operate multi-tenant infrastructure where one customer's abuse could impact another. If your Capgo instance is internet-facing and API keys have been distributed to partners or third parties, prioritize more urgently.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a Medium severity assessment. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring login credentials (PR:L) but no user interaction (UI:N). The impact is scoped to the service itself (S:U), with integrity compromised by unauthorized file creation (I:L) and availability affected by resource exhaustion (A:L). The score does not escalate to High because the vulnerability does not grant access to user data or enable remote code execution; it is bounded to abuse of the file upload mechanism.

Frequently asked questions