PT-2026-56429

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app versions.r2 path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2 path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on...