Cross-App Icon Update Authorization Bypass

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Capgo's PUT /app/:id endpoint contains an authorization flaw that allows attackers to update an application's icon URL to point to arbitrary image paths across different app namespaces. The vulnerability stems from insufficient validation—the endpoint accepts user-controlled icon values, normalizes them, and persists them to the database without verifying that the target image path belongs to the requesting user's app namespace. This means an attacker could modify one app's icon to reference confidential images from another organization's app, potentially exposing sensitive visual assets or triggering unintended backend processing. Any Capgo user or external attacker (depending on authentication controls) can exploit this to manipulate app metadata and access unauthorized resources, affecting the integrity and confidentiality of hosted applications.

Casky's 283 mapped skills detect this attack through MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Claude's extended reasoning identifies the authorization bypass pattern by correlating: (1) insufficient input validation on user-supplied paths, (2) lack of ownership checks before resource mutation, and (3) privilege escalation via service-role credential execution in downstream triggers. Practitioners using Casky would observe findings highlighting improper access control on the endpoint, missing authorization checks in the icon normalization logic, and the dangerous privilege boundary crossed when the on_app_update trigger executes with elevated service credentials. The skill mapping flags this as a CWE-639 (Authorization Bypass) instance and surfaces the data flow from user input through persistence to privileged operations—enabling defenders to prioritize remediation of input validation and ownership verification in the API endpoint.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100618.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-100618

Casky has 283 skills that investigate the attack patterns behind CVE-2026-100618. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn