CVE-2026-100618

Executive Summary

CVE-2026-100618 is an authorization flaw (CWE-639) in Capgo (capgo.app) affecting the app icon update path. An authenticated holder of an app-limited write API key can supply a crafted icon value to the PUT /app/:id endpoint, causing a privileged service-role worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly. With a CVSS score of 8.5 and high integrity impact, the vulnerability allows cross-tenant or cross-namespace modification of storage objects, though confidentiality impact is limited and no public exploit or patch exists at the time of this report.

Technical Analysis

The vulnerability resides in the app icon update path of the Capgo platform. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in the public.apps.icon_url database column. Critically, the application does not verify that the supplied image path belongs to the target app's own image namespace — for example, a legitimate path would follow the pattern org/{owner_org}/{app_id}/.... Because this namespace validation is absent, an authenticated user holding an app-limited write API key can supply a path referencing an object outside their authorized scope.

When apps.icon_url is updated, a database trigger named on_app_update fires. The trigger's worker reads record.icon_url and invokes cleanStoredImageMetadata(). This function executes with service-role credentials via supabaseAdmin(), which bypasses Supabase Storage Row Level Security (RLS). The privileged worker then downloads the referenced storage object and re-uploads it with upsert: true, effectively rewriting the object's content or metadata.

The core security failure is a classic Insecure Direct Object Reference / authorization bypass (CWE-639): user-controlled input (the icon path) is trusted and processed by a privileged component without an ownership check against the app's own namespace. The service-role context means the worker can access objects that the API key holder cannot directly read or write under Storage RLS, resulting in privilege escalation from an app-limited write key to the ability to modify arbitrary private image objects. All versions are affected, and no patched version was available at the time of the advisory. Insufficient technical detail is available regarding the exact normalization routine or any additional internal function names beyond those disclosed.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the attack chain below is inferred from the vulnerability class and the details in the advisory.

1. Reconnaissance/target identification: An attacker obtains an app-limited write API key for a Capgo tenant, for example through a compromised integration, a leaked key, or legitimate low-privilege access. The attacker identifies a target private image object outside their scope, such as an organization logo whose storage path is known or guessable (for example following the org/{owner_org}/{app_id}/... naming convention).

2. Triggering the flaw: The attacker sends a request to PUT /app/:id with a user-controlled icon value that points to the out-of-scope image path. The application normalizes this value and stores it in public.apps.icon_url without verifying that the path belongs to the target app's own image namespace.

3. Payload/execution method: The update to apps.icon_url fires the on_app_update trigger. The associated worker reads record.icon_url and calls cleanStoredImageMetadata(). Running with service-role credentials via supabaseAdmin(), the worker downloads the referenced storage object and re-uploads it with upsert: true. This action rewrites the out-of-scope private image object even though the API key holder lacks direct read or write access under Supabase Storage RLS.

4. Post-exploitation impact: The attacker can cause a privileged worker to overwrite private image objects belonging to other apps or organizations. Integrity impact is high, as image content or metadata can be altered without authorization. The confidentiality impact is low (CVSS C:L), and there is no direct availability or scope-confined impact. The attack is network-accessible, requires low privileges (a valid app-limited write key), and needs no user interaction.

Impact Assessment

CVE-2026-100618 carries a CVSS v3.1 base score of 8.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N. The attack is network-exploitable (AV:N) with low complexity (AC:L), requiring low privileges (PR:L) — specifically an app-limited write API key — and no user interaction (UI:N). The scope is changed (S:C), indicating that the vulnerable component impacts resources beyond its security authority, which aligns with the cross-namespace object rewrite enabled by the service-role worker. Confidentiality impact is low (C:L), integrity impact is high (I:H) due to unauthorized rewriting of private image objects, and availability impact is none (A:N).

From a business perspective, affected systems are Capgo deployments using Supabase Storage with the described PUT /app/:id update path and the on_app_update trigger. The blast radius includes any private image object whose path can be referenced by the crafted icon value, such as organization logos or other app-scoped assets. Because the worker operates with service-role credentials, the boundary enforced by Supabase Storage RLS is bypassed, undermining tenant isolation and the platform's authorization model. The high integrity impact and changed scope mean that even a low-privilege, app-limited key can cause cross-tenant or cross-namespace modification, which is significant for multi-tenant environments relying on namespace separation for data integrity.

Detection Guidance

Sigma Rule

title: Capgo App Icon Update Authorization Bypass (CVE-2026-100618)
id: 8f3c2b1a-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-100618 by supplying an out-of-scope icon path to PUT /app/:id in Capgo.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'PUT'
    cs-uri-stem|contains: '/app/'
  selection_trigger:
    cs-uri-query|contains: 'icon='
  selection_scope:
    cs-uri-query|re: 'icon=(https?://|/)?(org/|storage/v1/object/)'
  condition: selection_endpoint and selection_trigger and selection_scope
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate app icon updates referencing own namespace
level: high
tags:
  - attack.t1190
  - cve.2026.100618

YARA Rule

rule CVE_2026_100618_Capgo_Icon_Bypass
{
    meta:
        description = "Detects Capgo icon update requests attempting namespace bypass (CVE-2026-100618)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-100618"
        severity = "high"
    strings:
        $endpoint = "PUT /app/" ascii nocase
        $icon = "icon=" ascii nocase
        $ns = "org/" ascii nocase
        $storage = "storage/v1/object/" ascii nocase
        $trigger = "on_app_update" ascii nocase
        $clean = "cleanStoredImageMetadata" ascii nocase
    condition:
        ($endpoint and $icon and ($ns or $storage)) or ($trigger and $clean)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100618 Capgo App Icon Update Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/app/"; http.uri; content:"icon="; http.uri; pcre:"/icon=(https?:\/\/|\/)?(org\/|storage\/v1\/object\/)/i"; classtype:attempted-user; reference:cve,2026-100618; sid:2026100618; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "PUT" and http.request.uri : "/app/*" and http.request.uri : "*icon=*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=PUT uri_path="/app/*" uri_query="*icon=*"
| rex field=uri_query "icon=(?<icon_path>[^&]+)"
| where match(icon_path, "(?i)(org/|storage/v1/object/)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, icon_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="capgo,web,">
  <rule id="100618" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>PUT</match>
    <regex type="pcre2">\/app\/.*icon=(https?:\/\/|\/)?(org\/|storage\/v1\/object\/)</regex>
    <description>CVE-2026-100618: Capgo app icon update authorization bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100618,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict issuance and rotation of app-limited write API keys; enforce least privilege and short-lived credentials.
   • Monitor and alert on PUT /app/:id requests where the icon value references paths outside the caller's own app namespace (for example the org/{owner_org}/{app_id}/... pattern).
   • Where feasible, disable or tightly control the app icon update path until a fix is available, or add server-side validation that rejects any icon path not matching the target app's own image namespace.
   • Review Supabase Storage RLS policies and consider hardening the service-role worker used by the on_app_update trigger, for example by validating record.icon_url ownership before calling cleanStoredImageMetadata().

2. Patch/upgrade steps:

   • No patched version is available. Monitor the vendor (Capgo) for an official advisory and patched release. Once available, upgrade all Capgo deployments and re-test the PUT /app/:id icon update flow for namespace validation.

3. Long-term hardening:

   • Implement server-side ownership and namespace validation for all user-controlled storage path inputs before they are persisted or processed by privileged workers.
   • Avoid trusting database-triggered workers with service-role credentials for operations on user-controlled values without re-validating authorization context.
   • Apply defense-in-depth: enforce Storage RLS consistently, audit service-role usage, and adopt tenant isolation checks in every privileged code path that handles cross-tenant references.

References

• NVD — CVE-2026-100618: https://nvd.nist.gov/vuln/detail/CVE-2026-100618
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Capgo (capgo.app) — vendor site and advisory channel: https://capgo.app
• FIRST — EPSS (score not yet available at time of writing): https://www.first.org/epss
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100618 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-100618 at the time of this report.