CVE-2026-56250 Overview
CVE-2026-56250 is a missing authorization vulnerability [CWE-862] in Capgo versions before 12.128.2. The flaw allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST. Attackers can retarget the field to arbitrary Cloudflare R2 bundle objects belonging to other tenants. By soft-deleting the attacker-controlled version, the on_version_update cleanup function deletes the victim's R2 object.
Critical Impact
Attackers with an upload-scoped API key can delete arbitrary R2 bundle objects across tenants, causing denial of service and disruption of application bundle availability.
Affected Products
- Capgo versions prior to 12.128.2
- Deployments using PostgREST-exposed app_versions table
- Environments relying on Cloudflare R2 for bundle storage
Discovery Timeline
- 2026-07-08 - CVE-2026-56250 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-56250
Vulnerability Analysis
Capgo exposes the app_versions table through PostgREST for API-driven bundle management. The r2_path column, which points to the object in Cloudflare R2 storage, is treated as mutable. Upload-scoped API keys lack row-level authorization checks on updates to this column. This missing authorization enables cross-tenant tampering with object references.
Capgo maintains a database trigger named on_version_update that removes the referenced R2 object when a version is soft-deleted. Because the trigger trusts the current value of r2_path at deletion time, an attacker who first patches the path to a victim object then soft-deletes their own version causes the trigger to remove the victim's bundle.
Root Cause
The root cause is a missing authorization check [CWE-862] on the app_versions.r2_path field. PostgREST accepts PATCH requests from any holder of an upload-scoped key without validating that the target R2 path belongs to the caller's tenant or original upload.
Attack Vector
An attacker with a valid upload-scoped API key issues a PATCH request through PostgREST against a row they created, updating r2_path to reference a victim tenant's R2 object. The attacker then soft-deletes the row, triggering on_version_update. The cleanup logic issues a delete against the retargeted R2 path, removing the victim bundle. The attack is remote, requires no user interaction, and no elevated privileges beyond an upload key.
The vulnerability mechanism is documented in the GitHub Security Advisory and the VulnCheck Advisory.
Detection Methods for CVE-2026-56250
Indicators of Compromise
- PATCH requests to the PostgREST app_versions endpoint modifying r2_path values.
- Soft-delete operations on app_versions rows immediately following an r2_path update.
- Unexpected R2 object deletions in Cloudflare storage logs that do not correlate to legitimate version lifecycle events.
- Cross-tenant references where r2_path values point outside the owning tenant's prefix.
Detection Strategies
- Audit PostgREST access logs for unauthorized PATCH /app_versions requests originating from upload-scoped keys.
- Correlate database UPDATE events on r2_path with subsequent trigger executions of on_version_update.
- Alert on any r2_path value that does not match the expected tenant or app namespace prefix.
Monitoring Recommendations
- Enable Cloudflare R2 object access and deletion logging, and forward events to a central log store.
- Review API key usage patterns for anomalous write activity against version metadata.
- Track database triggers that produce external side effects such as object storage deletes.
How to Mitigate CVE-2026-56250
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later on all deployments.
- Rotate all upload-scoped API keys and audit their recent activity.
- Review R2 bucket contents and backups to identify and restore any deleted victim bundles.
Patch Information
Capgo release 12.128.2 addresses the vulnerability by restricting mutations of app_versions.r2_path and enforcing authorization on the cleanup workflow. Details are provided in the GitHub Security Advisory GHSA-pw8p-5jg6-cxj3.
Workarounds
- Restrict PostgREST update permissions on the app_versions table so upload-scoped roles cannot modify r2_path.
- Add a database constraint or trigger that rejects updates changing r2_path after initial insert.
- Modify the on_version_update cleanup logic to verify the r2_path prefix matches the tenant before deleting the R2 object.
- Enable versioning or soft-deletion on the R2 bucket so removed objects can be recovered.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
