{"schema":"threatline.record/2","record":{"id":"CVE-2026-100618","aliases":["GHSA-669c-gwrr-hc53"],"summary":"Capgo App Icon Update Privilege Escalation via Service-Role Worker","details":"Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.","categories":["Unclassified"],"product":"capgo.app","vendor":"Cap-go","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100618","source_modified_at":"2026-09-30T17:20:09.244Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"capgo.app","vendor":"Cap-go","versions":[{"version":"0","status":"affected","versionType":"custom","lessThanOrEqual":"*"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00207,"percentile":0.10206,"score_date":"2026-10-23"},"published_at":"2026-09-26T13:22:58.212Z","modified_at":"2026-09-30T17:20:09.244Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100618","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T17:20:09.244Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100618","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-669c-gwrr-hc53","tags":["exploit"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/capgo-app-icon-update-privilege-escalation-via-service-role-worker","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-28T19:01:08.396450Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T17:20:09.244Z","content_hash":"3314c9ea52d5b30ddd52684da6b2f155e16317c3546f499caeee39c0d0d28e13"}}