Capgo enforces a restrictive row‑level policy on its public.manifest table, but a privilege hierarchy flaw lets a principal with an app‑scoped upload/write/all API key or an authenticated user with write rights alter the app_versions.manifest entry for a version that uses the ‘r2‑direct’ storage provider. The on_version_update worker trusts the values in that manifest record and, using a service‑role Supabase client, inserts the attacker‑controlled file_name, file_hash and s3_path into public.manifest before clearing the app_versions entry. When a release channel points to the crafted version, the /updates endpoint serves the malicious manifest record as a download_url, effectively poisoning the OTA update process and delivering attacker code to any client that pulls the manifest. This results in a remote code delivery surface that can lead to execution on the device.

The vulnerability affects all installations of Capgo’s SaaS platform (Capgo). No version information is provided, and the issue was present in all affected releases at disclosure.

The flaw scores a CVSS of 8.7, indicating high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, but the attack path is clear for any entity holding an upload/write API key or an authenticated user with write access to an app. The exploited conditions require the use of the ‘r2‑direct’ storage provider and the ability to trigger the on_version_update worker; these prerequisites are typically satisfied in normal operational use, giving the vulnerability a high exploitability in practice.