Description

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:43.157Z",
  "pubdate": "2026-09-26T14:16:43.157Z",
  "executiveSummary": "The vulnerability identified in capgo.app (through version 12.129.0) constitutes an Improper Authorization flaw within the application's file delivery architecture. Specifically, the public file read endpoint fails to validate the deletion status of cached bundle artifacts, allowing unauthenticated actors to retrieve resources that have been logically removed from the primary storage layer.\nThe impact of this vulnerability is significant, as it permits unauthorized access to sensitive application bundles that should no longer be accessible. Furthermore, the exploitation process triggers a side effect where cached artifacts are inappropriately re-synchronized or restored into the underlying R2 storage infrastructure. This facilitates an information disclosure vector and an unintended data persistence mechanism, effectively bypassing access control policies. The vulnerability is exploitable by any remote, unauthenticated attacker possessing or guessing cached URLs, posing a substantial risk to application integrity and data privacy.",
  "technicalDetails": "The root cause of the vulnerability resides in the application's cache management logic for bundle artifacts. When a request is made to the public file read endpoint, the server prioritizes the delivery of cached content to optimize performance and reduce latency. However, the service fails to verify the current deletion status of the requested object within the application's source of truth (database or state management layer) before serving the response.\nThe attack flow begins when an attacker identifies or obtains a cached URL for a bundle that has been deleted by the owner or administrator. Because the endpoint does not perform an existence or authorization check against the object's current metadata, it serves the file from the cache layer regardless of its deleted status. A critical secondary component of this vulnerability is the interaction with the backend storage provider, specifically R2 storage.\nUpon a cache hit for a previously deleted bundle, the backend logic erroneously interprets the access request as a valid trigger for storage synchronization. As a result, the application re-imports or restores the deleted object into the R2 storage bucket. This effectively achieves two outcomes: the exfiltration of sensitive application code or data contained within the bundle, and the persistent re-instantiation of files intended for removal.\nAffected systems include all capgo.app versions up to 12.129.0. The vulnerability is exposed over the network, requiring no authentication or elevated privileges. Because the public file read endpoint is natively designed to serve external requests, it remains highly exposed to automated scanning or direct URL manipulation. Post-exploitation, attackers can continuously monitor and recover version-controlled assets, potentially leading to the discovery of hardcoded credentials, API keys, or sensitive business logic embedded within historically deleted bundles.\nThe interaction between the caching layer and the object storage API is decoupled from the authorization middleware, preventing the enforcement of access control lists (ACLs) or deletion status verification at the edge. The flaw represents a failure to implement a robust 'check-before-serve' mechanism in the caching architecture."
}