Description

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload that object with sanitized metadata. Attackers can silently modify metadata in cross-tenant image objects by supplying known victim keys during authorized row updates, bypassing storage access controls through the confused-deputy metadata worker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T14:16:42.050Z",
  "pubdate": "2026-09-26T14:16:42.050Z",
  "executiveSummary": "Capgo versions prior to 12.244.1 are susceptible to a cross-tenant integrity vulnerability residing within the metadata-cleaning worker component. This vulnerability stems from an insecure implementation where the service-role worker trusts image object keys retrieved from mutable database rows without enforcing strict ownership validation.\nThe flaw allows an authenticated attacker to perform a confused-deputy attack, forcing the system to process unauthorized assets. By injecting a victim's image key into a database record under the attacker's control, the attacker triggers the background worker to treat the victim's object as its own. This leads to the unauthorized modification of metadata on objects belonging to other tenants. The vulnerability effectively bypasses storage access controls, enabling silent metadata manipulation across tenant boundaries. The risk is significant, as it compromises the integrity of stored assets and demonstrates an escalation of privilege where a low-privileged authenticated user can affect the data state of higher-privileged or separate tenant environments.",
  "technicalDetails": "The root cause of this vulnerability is an insecure trust boundary in the Capgo metadata-cleaning worker. The component is designed to perform metadata sanitization on image objects, but it fails to verify that the requester (or the record owner) actually maintains authority over the image object identified by the key stored in the database.\nThe exploitation flow proceeds as follows: First, an attacker identifies a target object key belonging to a victim tenant within the application's storage layer. Second, the attacker performs an authorized update to a database row they control, inserting the victim's image object key into the metadata fields processed by the cleaning worker. Third, the metadata-cleaning worker, operating with a high-privilege service role, retrieves the object key from the attacker's row. Because the worker lacks cross-tenant validation logic, it assumes the key is legitimate and associated with the record currently being processed. Fourth, the worker fetches the victim's image object from storage, processes it, and performs a re-upload operation with sanitized metadata.\nThe exploitation leverages the worker's service-role identity to bypass standard storage-level access control lists (ACLs) or bucket policies that would otherwise prevent the attacker from directly accessing or modifying the victim's data. By inducing this confused-deputy behavior, the attacker can force the service to perform operations on objects they would not otherwise have permission to access. Post-exploitation impact includes the silent modification of image metadata, which could be used to corrupt service-dependent logic, manipulate display properties, or potentially facilitate further downstream vulnerabilities if metadata is processed by other components that trust the sanitized output. This flaw affects Capgo systems running versions prior to 12.244.1, requiring an authenticated session and the ability to influence database content associated with the metadata-cleaning worker."
}