Summary
Capgo contains a cross-tenant authorization flaw in its metadata-cleaning worker, which trusts image object keys from mutable database rows without confirming tenant ownership. An authenticated attacker who can reference a known object key in an authorized row update may cause the service-role worker to modify metadata on another tenant's image.
Affected context
The vulnerability occurs in deployments where the metadata-cleaning worker processes image object keys stored in mutable database rows and uses elevated service-role storage permissions. Risk is present when row updates can introduce object keys without an ownership check that binds the referenced object to the requesting tenant.
Exploit preconditions
- Attack surface: Authorized row-update functionality and the asynchronous metadata-cleaning worker
- Required access: Authenticated access sufficient to modify a row controlled by the attacker's tenant
- Trigger point: Worker processing of the modified row and its referenced image object
- Required knowledge: A victim tenant's image object key must be known or obtained
- Why exploitation is possible: The worker trusts the object key from the mutable row and uses service-role permissions without independently validating tenant ownership
Why this happens
The underlying bug is an authorization failure caused by trusting an indirect object reference without checking that the referenced resource belongs to the same tenant as the requesting principal. The worker acts as a privileged confused deputy: it follows a user-influenced image key and performs metadata operations under elevated permissions. This maps to CWE-639: Authorization Bypass Through User-Controlled Key, because access decisions are not enforced for the object identified by the supplied key.
Potential impact
- An attacker may modify metadata on image objects belonging to another tenant
- Cross-tenant data integrity could be compromised without changing image content
- Security, compliance, or provenance metadata can be silently altered
- The service-role worker could become a confused deputy for unauthorized storage operations
- Downstream workflows may make incorrect decisions based on tampered metadata
General mitigation guidance
Mitigation generally focuses on enforcing object-level authorization at every trust boundary and preventing privileged workers from treating user-controlled references as trusted.
Common defensive patterns include:
- Bind object references to tenant identifiers and verify that relationship before processing
- Perform server-side ownership checks against authoritative storage metadata
- Avoid relying solely on mutable database rows for authorization decisions
- Use narrowly scoped worker credentials and tenant-aware storage policies
- Reject references that cannot be resolved to the requesting tenant
- Preserve immutable audit records for metadata changes and cross-tenant access attempts
- Treat asynchronous workers as separate authorization boundaries rather than inheriting caller assumptions
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and code review checks for storage operations driven by user-controlled keys
- Searches for service-role or administrator credentials used with tenant-derived object references
- Review of database schemas and update paths for missing tenant-to-object integrity constraints
- Tests that attempt to reference objects owned by a different tenant
- Runtime monitoring for cross-tenant object access, unexpected metadata rewrites, and unusual worker activity
- Policy enforcement requiring explicit ownership checks before privileged storage operations
Automated security review tools may help flag authorization decisions based only on identifiers supplied by mutable records.
