CVE-2026-100618 Capgo App Icon Update Privilege Escalation via Service-Role Worker
Authenticated users can exploit missing authorization checks to trigger privileged workers to modify out-of-scope private storage objects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100618?
CVE-2026-100618 is a high-severity missing authorization vulnerability in Cap-go capgo.app, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.
Weakness: CWE-639
Which versions are affected by CVE-2026-100618?
How do I fix CVE-2026-100618?
No fix has been published for CVE-2026-100618 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100618 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100618 exists.
Sources
Also known as GHSA-v4jw-rcpm-rf82.