CyberRota Analysis
AI-GeneratedCapgo versions prior to 12.128.2 are vulnerable due to the ability of upload-scoped API keys to manipulate the mutable app_versions.r2_path field via PostgREST. This flaw allows attackers to redirect r2_path to arbitrary R2 bundle objects, potentially leading to denial of service by deleting victim objects. Organizations using affected Capgo versions should prioritize remediation to prevent service disruptions and protect their bundle availability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.