All vulnerabilities
CVE-2026-100626GHSA-84xq-4rv7-p252

capgo.app: capgo through 12.128.2 IDOR via PUT /app icon endpoint

Cap-go capgo.app
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published26 Sep 2026Updated 26 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.

Text from CVE List

Affected versions 1

  • capgo.appaffected: all versions through 12.128.2CVE List

References 2