CVE-2026-56335: Capgo Authorization Bypass Vulnerability

CVE-2026-56335 Overview

CVE-2026-56335 is an authorization bypass vulnerability in Capgo versions before 12.128.2. The flaw allows holders of write-scoped API keys to directly mutate protected channel configuration fields through PostgREST. The root cause is a null authentication check in the immutability trigger that fails to enforce restrictions when specific auth context values are absent. Attackers can modify sensitive channel attributes including public, allow_emulator, and other security-related flags outside intended application routes. The vulnerability is classified under [CWE-284] Improper Access Control.

Critical Impact
Attackers holding write-scoped API keys can bypass channel-level protections and alter security-sensitive configuration flags, undermining update channel integrity for downstream mobile applications.

Affected Products

Capgo versions prior to 12.128.2
Deployments exposing PostgREST endpoints backed by the Capgo schema
Self-hosted Capgo instances using write-scoped API key authentication

Discovery Timeline

2026-07-10 - CVE-2026-56335 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-56335

Vulnerability Analysis

Capgo enforces immutability on protected channel columns through a PostgreSQL trigger executed on update operations. The trigger inspects the current authentication context to decide whether the caller is permitted to mutate restricted fields. When the auth context value is null, the trigger short-circuits and permits the write instead of denying it. Write-scoped API keys presented through PostgREST reach the database without populating the expected auth claim, allowing the check to be bypassed. This turns a general-purpose write key into an administrative configuration key for channel objects.

The practical outcome is that any client with a write API key can flip flags governing channel visibility and emulator handling. These flags gate whether an update channel is public, whether it accepts emulator devices, and how downstream clients validate updates. Modifying them shifts the trust posture of the update distribution channel without going through the application layer that normally enforces role checks.

Root Cause

The immutability trigger treats a missing authentication identity as a non-privileged, non-restricted state rather than defaulting to deny. Combined with PostgREST exposing table-level mutations to any authenticated API key, the null branch collapses the intended separation between read-write data operations and administrative configuration operations.

Attack Vector

An attacker authenticates to the PostgREST endpoint using a legitimately issued write-scoped API key. The attacker issues a PATCH request against the channels resource setting fields such as public=true or allow_emulator=true. Because the trigger's authentication check evaluates to null, the update succeeds. No user interaction is required, and the attack is fully network-based against the exposed API surface.

See the GitHub Security Advisory and VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-56335

Indicators of Compromise

Unexpected PATCH or POST requests to PostgREST channel endpoints originating from write-scoped API key holders.
Audit log entries showing modifications to public, allow_emulator, or related channel security flags outside normal application deployment workflows.
Channel configuration state changes without a corresponding action in the Capgo web UI or CLI logs.

Detection Strategies

Compare database audit trails of channel table mutations against expected administrative actions from the Capgo application server.
Alert on any direct PostgREST traffic that targets channel configuration columns from API keys not associated with administrative roles.
Baseline the set of API keys that historically modify channel flags and flag deviations for investigation.

Monitoring Recommendations

Enable PostgreSQL row-level audit logging on the channels table and forward events to a centralized log platform.
Monitor PostgREST access logs for PATCH verbs targeting channel resources and correlate with API key identifiers.
Track channel flag drift over time and reconcile against source-of-truth deployment manifests.

How to Mitigate CVE-2026-56335

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later where the immutability trigger correctly handles the null authentication case.
Rotate all write-scoped API keys after upgrading and audit their assigned scopes.
Review channel configuration state for unauthorized changes to public, allow_emulator, and related fields, and revert any unexpected values.

Patch Information

Capgo maintainers released a fix in version 12.128.2. The corrected immutability trigger denies mutation of protected channel columns when the authentication identity is null, aligning with fail-closed semantics. Refer to the GitHub Security Advisory GHSA-ph9c-vwjq-pqhj for release details.

Workarounds

Restrict PostgREST network exposure so only the Capgo application server can reach it, blocking direct API key use against the database gateway.
Revoke or narrow write-scoped API keys until the upgrade is applied.
Add a database-level policy or additional trigger that explicitly denies updates to channel security columns when the JWT claim identifying an administrative role is absent.

bash

# Configuration example: restrict PostgREST to internal network only
# Example iptables rule limiting access to the application server
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP