Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100626capgo through 12.128.2 IDOR via PUT /app icon endpoint

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in capgo.app from Cap-go. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 92.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.

Affected products (as reported)

Vendor	Product	Versions
Cap-go	capgo.app	0 – through 12.128.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-84xq-4rv7-p252) vendor-advisory
VulnCheck Advisory: capgo through 12.128.2 IDOR via PUT /app icon endpoint third-party-advisory