Authorization Flaw in Capgo App for Image Update

CVE-2026-100618

What is CVE-2026-100618?

The Capgo application has a significant authorization flaw in its app icon update mechanism, specifically impacting the PUT /app/:id endpoint. This vulnerability allows an authenticated user, holding a limited write API key, to exploit the unverified normalization process of user-controlled icon values. By doing so, the attacker can overwrite images outside of their permitted namespace in Supabase Storage. When the icon URL is updated, privileged service-role operations are invoked, enabling the attacker to modify private image objects they should not have access to, such as organization logos. All versions of Capgo are affected, and no patch is currently available.

References