Cap-go's capgo.app implements a restrictive row-level security policy to block direct user inserts into the public.manifest table. However, this restriction can be bypassed indirectly by principals holding app-scoped upload/write/all API keys or authenticated users with write+ rights on an app. These users can update public.app_versions.manifest on versions with storage_provider set to 'r2-direct', which bypasses the bundle content-lock check. An asynchronous on_version_update worker then trusts the record.manifest and, using a service-role Supabase client, inserts attacker-controlled file_name, file_hash, and s3_path into public.manifest before clearing app_versions.manifest. When a channel points to this crafted version, the /updates endpoint returns the malicious manifest entry as a client-facing download_url, enabling over-the-air manifest poisoning through a trusted async worker path. All versions of capgo.app are affected. The service is cloud-hosted and a patch is available.

An attacker with upload/write API keys or write+ rights can inject malicious entries into the update manifest table, causing the /updates endpoint to serve attacker-controlled download URLs. This compromises the integrity of over-the-air updates by poisoning manifests, potentially leading to clients downloading malicious files. The vulnerability bypasses intended row-level security and content-lock checks, undermining update trustworthiness.

As capgo.app is a cloud-hosted service, the vendor manages remediation server-side. A patch is available to address this vulnerability. Users should verify with the vendor advisory that their instance is updated. No additional user action is required if the service is fully managed and patched.