CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability in Capgo versions prior to 12.128.2 allows read-only organization members to insert OTA manifest rows, potentially leading to metadata poisoning. This could enable attackers to deliver malicious assets to devices through the unauthenticated /updates endpoint. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized asset delivery.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_path values that are served to devices via the unauthenticated /updates endpoint, enabling OTA metadata poisoning and potential malicious asset delivery.