Capgo versions prior to 12.128.2 allow an attacker who holds an application‑scoped API key with full permissions to alter the app_versions database table via PostgREST, a feature that grants direct access to the underlying tables. By setting the session_key and key_id columns to NULL, the attacker can remove the cryptographic identifiers associated with an encrypted bundle, effectively downgrading the application package to an unencrypted state. This bypasses any organization‑enforced policy that requires bundles to remain encrypted and weakens the over‑the‑air update mechanism that relies on those encryption markers. The vulnerability is a classic instance of improper authorization control (CWE‑284).

All Capgo installations using a PostgREST data access layer and an app‑scoped API key that possesses “all” permissions are impacted. Versions older than 12.128.2 are vulnerable; no later fixes are documented in the current advisory.

The CVSS score of 5.3 places this flaw in the moderate severity range, while an EPSS score of <1% indicates a very low likelihood that the vulnerability will be actively exploited at this time. The vulnerability is not catalogued in the CISA KEV list, suggesting limited public exploitation. However, an attacker with the required PostgREST URL and a valid API key can readily execute the update query to clear the session_key and key_id fields, thereby enabling the downgrade attack. The operation requires no elevated privileges beyond the application‑scoped key set with all permissions, meaning that compromised or misconfigured keys can be used directly in the field.