Capgo releases before 12.128.2 allow upload‑scoped API keys to modify the app_versions.r2_path field through PostgREST. An attacker can change that path to point to any R2 bundle object and then trigger the on_version_update cleanup function by soft‑deleting a chosen version. The cleanup deletes the bundle at the new path, resulting in the loss of the victim’s bundle and disabling its availability to users. This flaw is a privilege‑escalation–type weakness that compromises the integrity and availability of bundle assets (CWE‑862).

The affected product is Capgo. Any deployment using Capgo prior to version 12.128.2 is susceptible. The vulnerability resides in the Capgo server application and the PostgREST interface that permits upload‑scoped API keys to alter rows in the app_versions table.

The CVSS score of 8.7 indicates high severity. EPSS is <1%, suggesting a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Inferred from the description, the likely attack vector is remote API exploitation using a compromised or otherwise valid upload‑scoped API key with write permission to the app_versions table via PostgREST. If an attacker can obtain such a key, they can modify r2_path, soft‑delete a benign version, and delete arbitrary R2 objects, causing denial of service to end users.