The vulnerability in Capgo prior to version 12.128.2 is an authorization bypass (CWE-284) where write-scoped API keys can exploit a null authentication check in the immutability trigger of PostgREST. This flaw permits direct mutation of protected channel configuration fields, including critical security flags, bypassing intended access controls. The issue arises because the immutability trigger does not properly verify authentication, allowing unauthorized modification of sensitive channel attributes by attackers possessing write API keys.

Attackers with write-scoped API keys can bypass authorization controls to modify sensitive channel configuration fields that should be immutable or restricted. This can lead to unauthorized changes in channel visibility, emulator allowances, and other security-related flags, potentially undermining the security posture of the affected application or service. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor vendor communications for updates. Until a fix is available, restrict issuance of write-scoped API keys and review channel configuration changes for unauthorized modifications.