Manifest Poisoning Vulnerability in Capgo by Capgo.app

CVE-2026-100619

What is CVE-2026-100619?

The Capgo app has a significant security flaw that enables manifest poisoning attacks through the app_versions.manifest bypass. The system initially blocks direct user inserts into the public.manifest table using a restrictive row-level security policy; however, this safeguard can be circumvented. An individual with an app-scoped API key or authenticated with write permissions can manipulate the version’s storage_provider set to 'r2-direct'. This oversight permits unauthorized insertion of malicious manifest data. Once a crafted version is accessed, the /updates endpoint presents a tainted download_url to the client, which poses serious risks, especially since this issue affects all versions of the product and no patch exists at this time.

References