CVE-2026-56220: Capgo Authorization Bypass Vulnerability

CVE-2026-56220 Overview

CVE-2026-56220 is an authorization bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the public.manifest INSERT policy, which fails to properly restrict write access based on organizational role. Read-only organization members can insert arbitrary Over-The-Air (OTA) manifest rows, including attacker-controlled s3_path values. Because the /updates endpoint is unauthenticated and serves these manifest entries to devices, attackers can poison OTA metadata and direct client devices to fetch malicious assets. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Read-only org members can inject malicious OTA manifest entries that are served to unauthenticated devices, enabling metadata poisoning and potential distribution of malicious update payloads.

Affected Products

Capgo versions prior to 12.128.2
Capgo public.manifest INSERT policy component
Capgo /updates OTA delivery endpoint

Discovery Timeline

2026-07-08 - CVE-2026-56220 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56220

Vulnerability Analysis

Capgo is an OTA update platform for Capacitor-based mobile applications. The backend uses row-level security (RLS) policies to determine which organization members can read from or write to specific tables. The public.manifest table stores manifest rows that describe update bundles, including the s3_path field pointing to the actual asset in object storage.

The INSERT policy on public.manifest does not verify that the requesting user holds a role higher than read-only within the organization. Any authenticated user with read-only org membership can therefore submit INSERT statements and register arbitrary manifest entries. Devices polling the unauthenticated /updates endpoint receive these entries and treat them as legitimate updates.

Root Cause

The root cause is a missing authorization check in the row-level security policy governing INSERT operations on public.manifest. The policy grants write access based on organization membership alone rather than validating the specific role assigned to the member. Read-only roles, which should be limited to SELECT operations, retain the ability to INSERT rows.

Attack Vector

An attacker requires low-privilege authenticated access as a read-only member of a Capgo organization. The attacker issues a crafted INSERT into public.manifest with an s3_path value pointing to an attacker-controlled or otherwise malicious object. When devices belonging to that organization request updates via the unauthenticated /updates endpoint, the poisoned manifest row is served. This yields an integrity impact on OTA delivery without requiring elevated privileges or user interaction.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-vmgg-crr8-887p and the VulnCheck Advisory on Capgo for further technical details.

Detection Methods for CVE-2026-56220

Indicators of Compromise

Unexpected rows in public.manifest created by user accounts holding only read-only organization roles.
Manifest entries containing s3_path values that point outside the organization's expected S3 prefix or reference unknown buckets.
Devices reporting update installations for bundle versions that were never published through the normal release workflow.

Detection Strategies

Audit database logs for INSERT statements against public.manifest and correlate the acting user's role at the time of the write.
Compare recent manifest rows against the authoritative release pipeline output to identify entries not produced by CI/CD.
Alert on any manifest row whose s3_path does not match the approved bucket, prefix, or naming convention.

Monitoring Recommendations

Enable PostgreSQL statement logging on the manifest table and forward logs to a centralized SIEM for review.
Monitor traffic to the /updates endpoint for anomalous version identifiers or spikes tied to unpublished releases.
Track organization role changes and correlate them with subsequent write activity on OTA-related tables.

How to Mitigate CVE-2026-56220

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which contains the corrected INSERT policy.
Review all manifest rows created before patching and remove any entries not produced by the legitimate release workflow.
Rotate or invalidate OTA bundles that may have been served from attacker-controlled s3_path values.

Patch Information

The vendor has released Capgo 12.128.2 addressing the authorization bypass. The fix tightens the public.manifest INSERT policy so that only organization roles with write privileges can insert manifest rows. Refer to the GitHub Security Advisory GHSA-vmgg-crr8-887p for the vendor-published remediation guidance.

Workarounds

Temporarily revoke read-only memberships from untrusted users until the upgrade is deployed.
Add a database-level trigger that rejects INSERTs on public.manifest from sessions whose role is read-only.
Serve the /updates endpoint through a reverse proxy that validates manifest s3_path values against an allow-list of approved bucket prefixes.

bash

# Configuration example: verify installed Capgo version meets the fixed release
npm ls @capgo/capacitor-updater | grep -E "@?12\.(12[89]|1[3-9][0-9]|[2-9][0-9]{2})\." \
  || echo "Capgo version is below 12.128.2 - upgrade required"