Capgo versions prior to 12.128.12 are vulnerable to a privilege escalation flaw that could allow unauthorized redeployment of application bundles, posing a significant risk to platform integrity.

This vulnerability (CWE-672) occurs because the software fails to properly filter deleted application versions when resolving updates. It allows authenticated attackers with low-level privileges and network access to force the deployment of bundles that were previously marked for removal.

With a CVSS score of 7.1, this vulnerability represents a High-severity risk. Successful exploitation allows unauthorized modification of application deployment states, potentially leading to the reactivation of legacy or insecure code versions. This compromises the integrity of the software delivery pipeline and could facilitate further unauthorized access or service disruption.

Immediate Action: Upgrade to Capgo version 12.128.12 or later to address the insufficient filtering logic.

Proactive Monitoring: Review application deployment logs for unexpected bundle activations or anomalies in channel update resolution processes.

Compensating Controls: Restrict network access to the Capgo update resolution endpoints to ensure that only trusted, authenticated users can interact with the deployment management interface.

Public Exploit Available: false

Given the potential for privilege escalation and the compromise of deployment integrity, administrators should prioritize updating to version 12.128.12 immediately. This update is necessary to ensure that the application correctly validates bundle status during the update resolution process and prevents the reactivation of deleted content.