CVE-2026-100626
Last modified
CVE-2026-100626 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization..
Description
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days to read cross-tenant objects including user avatars, organization logos, and app icons without authorization.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Cap-go | capgo.app | <= 12.128.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-100626?
How severe is CVE-2026-100626?
How do I fix CVE-2026-100626?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-100620Capgo CLI (npm package @capgo/cli) through 7.98.2 is affecte…3.8
- CVE-2026-100621Capgo (capgo.app) contains an incomplete access-control/cont…4.3
- CVE-2026-100622capgo.app through 12.129.0 fails to verify deletion status w…7.5
- CVE-2026-100623Capgo (capgo.app) exposes the legacy membership table public…8.8
- CVE-2026-100624Capgo.app before 12.264.5 does not enforce upload expiry or …5.4
- CVE-2026-100625Capgo (capgo.app) exposes a native build TUS upload proxy (s…7.1
- CVE-2026-100627Capgo (Cap-go/capgo.app) server backend Supabase functions c…8.1
- CVE-2026-100628capgo.app before 12.128.12 fails to enforce an organization'…4.3
- CVE-2026-100629Capgo (capgo.app backend) before 12.127.5 contains an author…5.5
- CVE-2026-10063A vulnerability was identified in TRENDnet TEW-432BRP 3.10B2…9.8
- CVE-2026-100630AVideo contains a stored cross-site scripting vulnerability …5.4
- CVE-2026-100631Parse Server is an open source backend server. In versions p…7.5
Are you affected by CVE-2026-100626?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST