CVE-2026-56217: Capgo Auth Bypass Vulnerability

CVE-2026-56217 Overview

CVE-2026-56217 is an access control weakness [CWE-284] in Capgo, an over-the-air (OTA) update service for Capacitor mobile applications. Versions before 12.128.2 fail to enforce organization-level encrypted-bundle policies when the app_versions table is updated through PostgREST. App-scoped API keys with the all permission can directly clear the session_key and key_id fields, downgrading previously encrypted OTA bundles to an unencrypted state. The flaw undermines integrity controls on mobile update distribution channels used by Capgo customers.

Critical Impact
Attackers holding a compromised app-scoped API key can silently disable encryption on OTA bundles, weakening the confidentiality and integrity guarantees of downstream mobile update delivery.

Affected Products

Capgo (@capgo/capgo) versions prior to 12.128.2
Self-hosted Capgo backend deployments exposing PostgREST
Mobile applications relying on Capgo organization-enforced encrypted bundle policies

Discovery Timeline

2026-07-08 - CVE-2026-56217 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56217

Vulnerability Analysis

Capgo distributes mobile application updates as bundles that organizations can require to be encrypted. Encryption metadata is stored on each app_versions row via the session_key and key_id columns. The backend exposes update operations through PostgREST, and enforcement of the encrypted-bundle policy is expected to occur when these columns change.

In releases prior to 12.128.2, the update path for app_versions does not evaluate the organization's encrypted-bundle policy when a request originates from an app-scoped API key. As a result, a caller with an all scope key can PATCH an existing row and set session_key and key_id to null, producing a valid but unencrypted bundle record. Clients pulling updates then receive plaintext payloads even when policy mandates encryption.

The vulnerability is a business logic and access control gap rather than a memory safety issue. Exploitation requires an authenticated API key, but no user interaction and no elevated privileges beyond the app scope already granted to CI systems and developer tooling.

Root Cause

The root cause is missing server-side policy enforcement on app_versions mutations. PostgREST accepts field-level updates that the application layer does not re-validate against the parent organization's enforce_encrypted_bundle setting. Row-level security and policy checks were scoped to bundle creation rather than to subsequent updates that clear encryption metadata.

Attack Vector

An attacker with a stolen or leaked app-scoped API key issues an authenticated HTTP PATCH request to the PostgREST endpoint fronting the app_versions table. The request targets a specific bundle row and sets session_key and key_id to null. Because the policy check is absent, the update succeeds and the bundle is served without encryption on the next client poll. The attack path is described in the GitHub Security Advisory and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-56217

Indicators of Compromise

PATCH or POST requests to the PostgREST /app_versions route that set session_key or key_id to null.
app_versions rows transitioning from encrypted (non-null session_key) to unencrypted state outside of a documented rotation.
API activity from app-scoped all keys performing direct table mutations rather than routed CLI operations.

Detection Strategies

Audit PostgREST access logs for app_versions update statements referencing the session_key or key_id columns.
Compare database change history against the organization's enforce_encrypted_bundle setting to surface policy violations.
Alert when a bundle previously served with encryption metadata is subsequently served without it.

Monitoring Recommendations

Forward Capgo backend, PostgREST, and database audit logs to a centralized SIEM or data lake for correlation.
Track API key usage per source IP and per action, flagging keys that begin issuing direct table updates.
Monitor mobile client telemetry for bundle format changes that do not correspond to a planned release.

How to Mitigate CVE-2026-56217

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed deployments.
Rotate all app-scoped API keys, especially any with the all permission, and reissue with least privilege.
Review recent app_versions history and re-encrypt any bundles whose session_key or key_id was cleared.

Patch Information

The fix is available in Capgo 12.128.2. The patched release enforces the organization's encrypted-bundle policy on app_versions updates, rejecting attempts to clear session_key or key_id when encryption is required. Refer to the GitHub Security Advisory GHSA-4qwf-mrgx-mvfx for release notes and commit references.

Workarounds

Restrict PostgREST access to app_versions at the network or reverse proxy layer until the upgrade is completed.
Revoke all scope from API keys and replace them with keys limited to specific, non-mutating actions.
Add a database trigger that rejects updates clearing session_key or key_id when the parent organization requires encrypted bundles.

bash

# Example database trigger to block downgrade to unencrypted bundles
CREATE OR REPLACE FUNCTION enforce_bundle_encryption()
RETURNS trigger AS $$
BEGIN
  IF NEW.session_key IS NULL OR NEW.key_id IS NULL THEN
    IF EXISTS (
      SELECT 1 FROM orgs o
      WHERE o.id = NEW.owner_org
        AND o.enforce_encrypted_bundle = true
    ) THEN
      RAISE EXCEPTION 'Encrypted bundle policy prevents clearing session_key/key_id';
    END IF;
  END IF;
  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

CREATE TRIGGER trg_enforce_bundle_encryption
BEFORE UPDATE ON app_versions
FOR EACH ROW EXECUTE FUNCTION enforce_bundle_encryption();