The vulnerability in capgo.app (up to version 12.128.2) is an insecure direct object reference in the PUT /app/:appId endpoint. This endpoint accepts attacker-controlled paths for icon storage in a private images bucket. Authenticated users can supply arbitrary paths and receive service-role-signed URLs valid for 7 days, enabling them to read objects belonging to other tenants without proper authorization.

An authenticated user can bypass authorization controls to access private objects belonging to other tenants, including user avatars, organization logos, and app icons. The URLs provided are valid for 7 days, potentially exposing sensitive or private information across tenants. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond authentication, and low impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected endpoint where possible and review access controls to limit exposure.