The vulnerability is an insecure direct object reference in the PUT /app/:appId endpoint of Capgo App version 12.128.2. The endpoint accepts an attacker‑controlled path for an app icon, allowing an authenticated user to generate service‑role signed URLs that grant read access to the private images bucket for seven days. This enables an attacker to read user avatars, organization logos, and other app icons belonging to other tenants without authorization. The breach of confidentiality is caused by an IDOR weakness and can expose sensitive user information.

Affected systems are the Cap‑go Capgo App, specifically deployments running version 12.128.2. The product is identified by the CNA vendor Cap‑go:capgo.app. No other products or versions are listed as affected in the CNA data.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user of the service; once authenticated, the attacker supplies a crafted icon storage path to obtain a signed URL. The signed URL grants read access to cross‑tenant objects for up to seven days, making the attack straightforward for an attacker with legitimate credentials. Given the lack of a KEV listing and moderate score, the risk is moderate but should trigger patching and additional controls.