CVE-2026-56302
Description
Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs.
Summary dbcve.org
Capgo before version 12.128.2 has an unsecured cloud storage bucket for app icons that lacks both authentication requirements and row-level security controls. Unauthenticated remote attackers can read, insert, and delete icon files, enabling them to delete all stored icons and exfiltrate sensitive app IDs and user IDs embedded in the stored data.
Mitigation
Enable authentication on the storage bucket, implement row-level security policies to restrict access to authorized users only, and configure least-privilege IAM policies to prevent unauthorized CRUD operations.