CVE-2026-56302 Capgo CVE debrief

Who should care

Defenders managing Capgo applications, especially those using Supabase for storage, should assess their exposure to this vulnerability and verify the security of their storage buckets.

Why it matters

CVE-2026-56302 is a medium-severity vulnerability in Capgo that allows unauthenticated attackers to access and manipulate stored app icons due to an unsecured images bucket in Supabase. Defenders should verify exposure, especially if using Capgo with Supabase, and assess storage bucket security.

• Verification of exposure to unauthorized access and data leakage due to the unsecured images bucket.
• Potential deletion of all icons and leakage of sensitive app IDs and user IDs.
• Assessment of the security configuration of the Supabase images bucket to prevent similar vulnerabilities.
• Prioritization of updates to Capgo version 12.128.2 or later to address the vulnerability.

Technical summary

The vulnerability in Capgo arises from an unsecured images bucket in Supabase that lacks row-level security controls. This allows unauthenticated attackers to read, insert, and delete stored app icons, potentially leading to the deletion of all icons and leakage of sensitive app IDs and user IDs. Defenders should prioritize verifying exposure to this vulnerability, especially if using Capgo with Supabase for storage, and assess the security of their storage buckets. The issue can be addressed by updating Capgo to version 12.128.2 or later and ensuring proper security configurations are in place for the Supabase images bucket.

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability, especially if using Capgo with Supabase for storage, and assess the security of their storage buckets.

Recommended defensive actions

• Verify the version of Capgo being used and check if it is vulnerable (less than 12.128.2).
• Assess the security configuration of the Supabase images bucket to ensure row-level security controls are in place.
• Consider updating Capgo to version 12.128.2 or later to address the vulnerability.
• Review and monitor the Supabase storage for any unauthorized access or changes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE description and source references indicate that the vulnerability exists in Capgo before version 12.128.2 and involves an unsecured images bucket in Supabase. Official sources include the CVE Program and NVD.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.