Description

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-26T14:16:43.703Z",
  "pubdate": "2026-09-26T14:16:43.703Z",
  "executiveSummary": "Capgo through version 12.128.2 contains an Insecure Direct Object Reference (IDOR) vulnerability within the PUT /app/:appId endpoint. This flaw permits an authenticated attacker to manipulate storage path parameters to access unauthorized resources residing in the private images bucket.\nThe vulnerability enables unauthorized retrieval of cross-tenant sensitive assets, including user avatars, organizational logos, and application icons. By injecting arbitrary path strings, an attacker forces the application to generate service-role-signed URLs for objects belonging to other tenants. These signed URLs remain valid for a duration of seven days, granting the attacker persistent unauthorized read access to private data. The flaw represents a significant breakdown in access control logic, as the backend fails to validate that the requested resource path belongs to the authenticated user's scope or organization. Given that the impact involves the unauthorized disclosure of cross-tenant proprietary and private data, this vulnerability is critical for environments relying on multi-tenant isolation. No specific complex exploit chains are required, as the vulnerability is directly reachable via standard API interaction by any authenticated user.",
  "technicalDetails": "The vulnerability resides in the request processing logic of the PUT /app/:appId endpoint. When updating application metadata, the endpoint fails to properly sanitize or authorize the 'icon storage path' parameter provided by the client. An attacker can supply a crafted path pointing to assets stored within the private images bucket that are outside their own authorized tenant context.\nThe attack flow proceeds as follows: First, the attacker authenticates to the Capgo platform. Second, they initiate a PUT request to the /app/:appId endpoint, including a malicious payload in the request body that specifies an arbitrary file path corresponding to a target object (e.g., another user's avatar or a separate organization's logo). Third, the vulnerable backend component processes the request and generates a service-role-signed URL for the specified path. Because the service role possesses broad read permissions across the storage bucket, the application generates a valid URL without verifying that the requesting user owns the resource or has permission to access the specified path.\nThe generated signed URL is then returned to the attacker. Because the service-role-signed URL is configured with a seven-day expiration, the attacker can leverage this window to exfiltrate the target data repeatedly. The root cause is a lack of server-side authorization checks and path validation; the application blindly trusts the user-supplied input to generate access tokens for the object storage layer. This bypasses the multi-tenant logical partitioning intended by the platform's architecture. The scope of exposure includes any object stored within the private images bucket, effectively nullifying tenant isolation for all assets stored therein. As the vulnerability is located in the application's core API handling logic, it affects all deployments of Capgo through 12.128.2 where the PUT /app/:appId functionality is exposed."
}