CVE-2026-56249: Capgo Auth Bypass Vulnerability

CVE-2026-56249 Overview

Capgo before version 12.128.2 contains an authorization bypass vulnerability in its channel creation endpoint. Authenticated users with the app.create_channel permission can overwrite existing channels by reusing their names. The flaw stems from a logic mismatch between existence validation and upsert operations in the POST /channel handler. Attackers exploit this mismatch to reassign channel ownership and modify production channel configurations. The vulnerability is categorized under CWE-285: Improper Authorization.

Critical Impact
Authenticated attackers can hijack existing channels, take over ownership, and alter critical production channel configurations without proper authorization checks.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Self-hosted Capgo deployments running vulnerable channel creation endpoints
Any application relying on Capgo channel-based OTA update distribution

Discovery Timeline

2026-06-30 - CVE-2026-56249 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56249

Vulnerability Analysis

The vulnerability resides in the POST /channel endpoint of Capgo. The endpoint performs an existence check to determine whether a channel with the requested name already exists. However, the subsequent database operation uses an upsert pattern that ignores ownership constraints. An authenticated user with app.create_channel permission submits a request specifying a channel name owned by a different user or application. The existence validation branch does not reject the request, and the upsert path overwrites the target record.

The result is a channel takeover. The attacker becomes the new owner and can modify metadata, associated version bindings, and distribution settings. In the context of Capgo, which distributes over-the-air (OTA) updates to mobile applications, control over a channel can influence which update payload is served to end users.

Root Cause

The root cause is a logic mismatch between the read-side existence check and the write-side upsert operation. The check enforces name uniqueness at the surface level but does not enforce ownership as an authorization boundary. The upsert therefore treats a name collision as an update event rather than rejecting the request as an unauthorized modification. This maps directly to CWE-285: Improper Authorization.

Attack Vector

Exploitation requires network access to the Capgo API and valid credentials with the app.create_channel permission. The attacker issues a POST /channel request specifying the name of an existing target channel. No user interaction is required. See the GitHub Security Advisory GHSA-vj24-j594-3wv3 and the VulnCheck Advisory for full technical details.

Detection Methods for CVE-2026-56249

Indicators of Compromise

Unexpected changes to channel owner_org or created_by fields in the Capgo database
POST /channel requests where the response indicates an update to a pre-existing channel rather than a new insert
Sudden ownership reassignment of production channels such as production, stable, or default
Modifications to channel-to-version bindings not correlated with a legitimate release workflow

Detection Strategies

Audit application logs for POST /channel calls that collide with existing channel names
Query the channels table for records whose updated_at timestamp changed without a corresponding release deployment event
Correlate API access tokens used in POST /channel calls against the historical owner of each affected channel

Monitoring Recommendations

Enable persistent logging of all channel creation and modification API calls, including caller identity and target channel name
Alert on any channel ownership change that occurs outside an approved administrative workflow
Track version-to-channel binding changes and require review for production channel updates

How to Mitigate CVE-2026-56249

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed deployments
Audit existing channels for unauthorized ownership changes and restore legitimate owners
Rotate API tokens for any account with app.create_channel permission if compromise is suspected
Review recent OTA update deployments served through affected channels for tampering

Patch Information

The issue is resolved in Capgo 12.128.2. Refer to the GitHub Security Advisory GHSA-vj24-j594-3wv3 for the fixed commit and upgrade instructions.

Workarounds

Restrict the app.create_channel permission to a minimal set of trusted service accounts until the patch is applied
Place the Capgo API behind an authorization proxy that validates channel ownership before forwarding POST /channel requests
Implement a database-level unique constraint combined with an ownership check to reject cross-owner name collisions

bash

# Configuration example: upgrade Capgo self-hosted deployment
npm install @capgo/cli@latest
# Verify installed version is 12.128.2 or later
npx @capgo/cli --version