CVE-2026-56309: Capgo Auth Bypass Vulnerability

CVE-2026-56309 Overview

CVE-2026-56309 affects Capgo versions prior to 12.128.2. The vulnerability resides in the /files/upload/attachments endpoint, which fails to enforce plan and quota restrictions. Attackers holding upload-scoped API keys can bypass plan checks and create publicly readable Cloudflare R2 objects. The uploaded attachments persist outside normal bundle metadata and survive app deletion, enabling sustained storage and bandwidth abuse. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Authenticated attackers with upload-scoped API keys can bypass plan restrictions to upload arbitrary attachments, resulting in storage and bandwidth abuse against Capgo tenants.

Affected Products

Capgo versions before 12.128.2
Self-hosted Capgo deployments exposing the /files/upload/attachments endpoint
Capgo tenants provisioned with upload-scoped API keys

Discovery Timeline

2026-07-10 - CVE-2026-56309 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-56309

Vulnerability Analysis

Capgo is an open-source live update server for Capacitor mobile applications. The /files/upload/attachments endpoint processes attachment uploads and forwards them to Cloudflare R2 object storage. In releases before 12.128.2, the endpoint does not consult the plan enforcement layer that gates other upload paths. This omission allows apps that should be plan-blocked to continue writing objects to R2.

The resulting objects are created with public read access and stored independently of bundle metadata. Because the storage records are decoupled from the app lifecycle, deleting the associated app does not remove the objects. Attackers can leverage this behavior to abuse tenant storage quotas and outbound bandwidth over time.

Root Cause

The root cause is a missing authorization and quota check on a single API route. Plan validation logic exists elsewhere in the Capgo codebase, but the attachments endpoint bypasses it. Combined with upload-scoped API keys — which are intentionally narrower than administrative tokens — this design gap permits privilege elevation from a limited key to unmetered storage writes.

Attack Vector

Exploitation requires network access to a vulnerable Capgo instance and possession of a valid upload-scoped API key. The attacker sends HTTP POST requests to /files/upload/attachments with arbitrary file payloads. Each request produces a publicly readable R2 object that persists indefinitely. No user interaction is required, and the operation succeeds even when the associated app has been suspended, blocked by plan limits, or subsequently deleted. See the GitHub Security Advisory GHSA-q52j-ggvx-cr4v and the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-56309

Indicators of Compromise

Unexpected growth in Cloudflare R2 object counts or storage size for tenants that have exceeded plan limits
R2 objects present for apps that have been deleted or suspended
Sustained POST traffic to /files/upload/attachments from a small set of API keys
Publicly readable R2 objects that are not referenced by any bundle metadata record

Detection Strategies

Correlate access logs for /files/upload/attachments against the plan status of the calling app to surface requests that should have been blocked
Reconcile the R2 bucket inventory with bundle metadata tables and flag orphaned objects
Track per-API-key upload rates and alert on keys that write attachments while their parent app is plan-blocked

Monitoring Recommendations

Enable request logging on the Capgo API gateway with retention sufficient to investigate storage anomalies
Configure billing and quota alerts on the Cloudflare R2 bucket backing Capgo attachments
Review upload-scoped API key usage patterns weekly, revoking keys with no legitimate activity

How to Mitigate CVE-2026-56309

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted deployments
Rotate upload-scoped API keys after upgrading to invalidate any keys that may have been abused
Audit the R2 bucket for orphaned public objects and remove attachments not tied to active bundles

Patch Information

Capgo maintainers released version 12.128.2, which enforces plan and quota checks on the /files/upload/attachments endpoint. Details are documented in the GitHub Security Advisory GHSA-q52j-ggvx-cr4v. Operators of managed Capgo services should confirm the patch has been applied by their provider.

Workarounds

Restrict network access to /files/upload/attachments at the reverse proxy or WAF until the patch is applied
Revoke or scope down upload API keys for apps that have been plan-blocked or deleted
Apply object lifecycle policies on the R2 bucket to expire attachments that are not referenced by bundle metadata

bash

# Configuration example: block the attachments endpoint at the reverse proxy until patched
location /files/upload/attachments {
    return 403;
}