A misconfigured Supabase images bucket in Capgo before 12.128.2 lacks row level security, permitting unauthenticated users to read, insert, and delete app icons. This allows attackers to gather sensitive app IDs and user IDs, as well as delete all stored icons. The primary impact is information disclosure and the potential loss of critical display assets, which could affect the integrity of the application‑hosted content.

Capgo deployments running any version earlier than 12.128.2 are affected. The vulnerability exists in the Supabase bucket handling the images storage for app icons.

The CVSS base score of 6.9 indicates medium severity. No exploit probability score is provided, and the vulnerability is not listed as an actively exploited vulnerability in the CISA KEV catalog. The vulnerability can be triggered by unauthenticated HTTP requests to the Supabase bucket; exploitation does not require special privileges or zero‑day exploits. Attackers can straightforwardly delete or read icons, and leak app and user identifiers by directly accessing the bucket location.