Capgo (capgo.app) contains an authorization flaw in the icon update path. The PUT /app/:id endpoint accepts a user‑controlled icon value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace. When the icon is updated the on_app_update trigger fires, and a worker running with service‑role credentials (supabaseAdmin()) downloads and re‑uploads the referenced storage object with upsert: true. An authenticated holder of an app‑limited write API key can therefore cause the privileged worker to rewrite an out‑of‑scope private image object, such as an organization logo, that the key cannot normally read or write under Supabase Storage RLS. This vulnerability permits privilege escalation, allowing an attacker to modify data beyond their allowed scope.

All versions of Capgo (capgo.app) are affected. The vulnerability applies to every released instance of the platform, regardless of version, as no patched release was available at the time the advisory was published.

The CVSS score of 8.7 classifies this as a high‑severity flaw, and the lack of an existing patch increases urgency. While the EPSS score is not available, the vulnerability relies on an authenticated app‑limited write API key, a credential that many users possess. The privileged worker executes with elevated service‑role permissions, making the escalation unimpeded and straightforward once the icon field is supplied. Because the affected objects include private images that are normally protected by Supabase RLS, an attacker can subvert those controls with relative ease. The vulnerability is not listed in the CISA KEV catalog, but its high severity and the ease of exploitation warrant prompt action.