CVE-2026-100614: Authorization Bypass Through User-Controlled Key in Cap-go capgo.app
Capgo versions before 12.244.1 have an authorization bypass vulnerability in a metadata-cleaning worker. This worker trusts image object keys from mutable database rows without verifying ownership, allowing an authenticated attacker to manipulate metadata of images belonging to other tenants. By supplying a victim tenant's image key in a row they control, attackers can cause the service to download and re-upload the victim's image with altered metadata, bypassing storage access controls.
AI Analysis
Technical Summary
CVE-2026-100614 describes a cross-tenant integrity vulnerability in Capgo before version 12.244.1. The metadata-cleaning worker component trusts image object keys from mutable database rows without validating that the requester owns those keys. An authenticated attacker can exploit this by placing a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload the victim's image object with sanitized metadata. This confused-deputy scenario allows attackers to silently modify metadata in cross-tenant image objects, bypassing storage access controls.
Potential Impact
An authenticated attacker can bypass storage access controls to modify metadata of image objects belonging to other tenants. This could lead to unauthorized data manipulation across tenants, impacting data integrity and potentially causing trust and operational issues within the multi-tenant environment.
Mitigation Recommendations
A fix is available in Capgo version 12.244.1 and later. Users should upgrade to version 12.244.1 or newer to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.
CVE-2026-100614: Authorization Bypass Through User-Controlled Key in Cap-go capgo.app
Description
Capgo versions before 12.244.1 have an authorization bypass vulnerability in a metadata-cleaning worker. This worker trusts image object keys from mutable database rows without verifying ownership, allowing an authenticated attacker to manipulate metadata of images belonging to other tenants. By supplying a victim tenant's image key in a row they control, attackers can cause the service to download and re-upload the victim's image with altered metadata, bypassing storage access controls.
CVSS v4.0
Score 8.7high
Affected software
Cap-go
capgo.app
pkg:github/cap-go/capgo.appRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100614 describes a cross-tenant integrity vulnerability in Capgo before version 12.244.1. The metadata-cleaning worker component trusts image object keys from mutable database rows without validating that the requester owns those keys. An authenticated attacker can exploit this by placing a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload the victim's image object with sanitized metadata. This confused-deputy scenario allows attackers to silently modify metadata in cross-tenant image objects, bypassing storage access controls.
Potential Impact
An authenticated attacker can bypass storage access controls to modify metadata of image objects belonging to other tenants. This could lead to unauthorized data manipulation across tenants, impacting data integrity and potentially causing trust and operational issues within the multi-tenant environment.
Mitigation Recommendations
A fix is available in Capgo version 12.244.1 and later. Users should upgrade to version 12.244.1 or newer to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:30:34.353Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9a1f7a7c5410652fcff
Added to database: 09/26/2026, 13:33:21 UTC
Last enriched: 09/26/2026, 14:18:54 UTC
Last updated: 09/26/2026, 15:39:44 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.