Access Control Bypass in Capgo Affects All Versions

CVE-2026-100621

What is CVE-2026-100621?

Capgo, an application hosted on capgo.app, suffers from an incomplete enforcement of access control mechanisms that compromises content-lock integrity in all versions. Due to a flaw in how it processes app_versions with a previous storage_provider of r2-direct, attackers can modify critical metadata fields such as session_key and checksum while content remains in a mutable state. Furthermore, the /updates endpoint inadequately filters out certain versions, allowing unauthorized modifications. An attacker possessing a valid API key with upload permissions may exploit this vulnerability, modifying bundle metadata and compromising the integrity of content delivered to users.

References