Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100618Capgo App Icon Update Privilege Escalation via Service-Role Worker
High 8.5
In plain English
A high-severity authorization bypass via user-controlled key in capgo.app from Cap-go. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
References
- GitHub Security Advisory (GHSA-669c-gwrr-hc53) vendor-advisory
- VulnCheck Advisory: Capgo App Icon Update Privilege Escalation via Service-Role Worker third-party-advisory