CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability in Capgo prior to version 12.128.2 allows attackers with write-scoped API keys to directly modify sensitive channel configuration fields, including security-related attributes, due to a null authentication check. This could lead to unauthorized changes in application behavior and security settings. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.