Capgo Policy Bypass Vulnerability in App Versions Update Enforcement

A policy bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows app-scoped API keys to downgrade encrypted bundles to a non-encrypted state, bypassing organization-enforced policies. The issue arises because the database only enforces bundle encryption requirements on insertion, leaving a gap that can be exploited by directly updating the app_versions table via PostgREST. This manipulation clears important fields, undermining over-the-air security controls.

Impact

Exploitation of this vulnerability allows app-scoped API key holders to violate an organization's encrypted-bundle security policy, downgrading existing bundle metadata from encrypted to non-encrypted. This breach of policy can lead to a loss of integrity in bundle protection, potentially weakening runtime guarantees that depend on the encryption state.

Reproduction

To reproduce this vulnerability, first enable the organization's encrypted-bundle enforcement. Then, identify an existing encrypted bundle row within the organization. Using an app-scoped API key that has permission to modify app_versions, send a direct PostgREST PATCH request to the app_versions table, clearing the session_key and key_id fields. This update will downgrade the bundle from encrypted to non-encrypted, bypassing the enforced policy.

Remediation

The vulnerability can be remediated by applying the same encrypted-bundle invariant on updates to the public.app_versions table, blocking any changes that would clear or invalidate the session_key when the organization enforces encrypted bundles. Additionally, key_id should be validated against the required_encryption_key during updates.