CVE-2026-56302: Capgo Information Disclosure Flaw

CVE-2026-56302 Overview

CVE-2026-56302 affects Capgo versions before 12.128.2. The application uses a Supabase storage bucket for app icons without configuring row level security (RLS) controls. Unauthenticated remote attackers can read, insert, and delete objects in the bucket. Successful exploitation lets attackers wipe stored app icons and harvest sensitive app IDs and user IDs from object metadata. The weakness maps to CWE-284: Improper Access Control.

Critical Impact
Network-reachable attackers can delete every stored app icon and leak app and user identifiers without authentication.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo instances backed by Supabase storage
Deployments that did not apply hardened bucket policies

Discovery Timeline

2026-06-24 - CVE-2026-56302 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56302

Vulnerability Analysis

Capgo provides over-the-air updates for Capacitor applications and stores app icon assets in a Supabase storage bucket. In versions before 12.128.2, the images bucket was created without any row level security policies. Supabase storage relies on PostgreSQL RLS to enforce per-object authorization, so the absence of policies left the bucket effectively public for read and write operations. Anyone able to reach the Supabase REST endpoint can list objects, download icons, upload new files, and delete existing entries. Object keys embed app IDs and user IDs, which exposes sensitive tenant metadata when listed.

Root Cause

The root cause is a missing access control configuration rather than a code defect. The bucket was provisioned without the RLS policies that Supabase requires to restrict storage operations. Without explicit SELECT, INSERT, UPDATE, and DELETE policies tied to authenticated roles, the default behavior allows the anonymous anon API key to perform all object operations.

Attack Vector

An attacker only needs the public Supabase project URL and the anonymous API key, both of which are typically shipped inside the client application. Using the standard Supabase storage REST API, the attacker enumerates objects in the images bucket, downloads icons to parse embedded identifiers, and issues DELETE requests against arbitrary object paths. The same flow supports uploading attacker-controlled content under existing keys.

No verified exploit code is published. See the GitHub Security Advisory GHSA-8hq3-gg3m-vwvr and the VulnCheck Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-56302

Indicators of Compromise

Unexplained deletions or modifications of objects in the Capgo images storage bucket
Anonymous anon role activity in Supabase storage logs targeting bucket paths containing app or user identifiers
Outbound requests from unknown IP addresses to the Supabase storage REST endpoint enumerating object keys

Detection Strategies

Audit Supabase storage logs for LIST, DELETE, and PUT operations against the images bucket performed by unauthenticated sessions
Compare current bucket contents against known-good snapshots to identify missing or tampered icon assets
Review Supabase database policy metadata to confirm whether RLS is enabled on the storage.objects table for this bucket

Monitoring Recommendations

Forward Supabase audit and storage logs to a centralized log platform and alert on anonymous write or delete operations
Track the Capgo release feed and inventory installations running versions before 12.128.2
Monitor application telemetry for missing icon fetch responses, which can indicate object deletion in the bucket

How to Mitigate CVE-2026-56302

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later
Enable row level security on the storage.objects table and apply policies restricting the images bucket to authenticated, owner-scoped operations
Rotate any Supabase service role keys that may have been exposed and review recent storage activity for unauthorized changes
Restore deleted or tampered icon assets from backup if evidence of exploitation is found

Patch Information

Capgo addresses CVE-2026-56302 in version 12.128.2. The fix introduces RLS policies on the images bucket so that only authorized roles can read or modify objects. Refer to the GitHub Security Advisory GHSA-8hq3-gg3m-vwvr for upgrade guidance.

Workarounds

Manually apply Supabase RLS policies that limit SELECT, INSERT, UPDATE, and DELETE on the images bucket to the owning user role
Temporarily set the bucket to private and disable anonymous access until the patched version is deployed
Restrict network access to the Supabase project using allow-listed origins where feasible

bash

# Example Supabase RLS policy to restrict the images bucket to owners
alter table storage.objects enable row level security;

create policy "images_owner_read" on storage.objects
  for select using (bucket_id = 'images' and auth.uid() = owner);

create policy "images_owner_write" on storage.objects
  for insert with check (bucket_id = 'images' and auth.uid() = owner);

create policy "images_owner_delete" on storage.objects
  for delete using (bucket_id = 'images' and auth.uid() = owner);