PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 103 By PatchDayAlert

Capgo MFA bypass lets attackers mint persistent API keys, plus MongoDB GridFS injection across 3 drivers

CVE-2026-88861 (CVSS 8.3) skips Capgo's second factor entirely and opens OTA config tampering with no patch available. Three MongoDB driver bugs (Ruby, Python, C#, all CVSS 8.3) let authenticated users read or destroy GridFS files via query injection. A WooCommerce refund plugin adds an unauth access control hole at CVSS 7.5.

Patch now
1
Within 24h
1
This week
3
Exploited
0
CapgoSupabaseCloudWooCommerceWordPressReturn Refund And Exchange For WooCommerceLinuxWindowsMongoDBMongoDB Ruby DriverMacOSPyMongo

Nothing's on fire yet, but a few of these need your attention before the weekend. Capgo has an MFA bypass (CVE-2026-88861, CVSS 8.3) that lets an attacker with a stolen password skip the second factor entirely, mint persistent API keys, and mess with your OTA configs. No patch exists yet, so you'll need a workaround. MongoDB also shipped fixes for the same GridFS query injection bug across 3 drivers (Ruby, Python, C#), all CVSS 8.3.

Today's CVEs

Sorted by urgency

01

CVE-2026-88861

NVD
8.3
CVSS
Patch now HIGH
CapgoSupabaseCloud

An attacker who knows a user's password can log into Capgo with just that password, completely bypassing MFA, because the Edge middleware never checks whether the session actually completed the second factor. Worse, they can mint a persistent API key that survives logout and then tamper with production OTA channel configs, like swapping which app bundle gets pushed to devices. No patch exists yet.

Affected estate
Teams running Capgo (Cap-go/capgo.app) for mobile OTA updates, especially anyone relying on MFA to protect admin accounts
How to check
Review your Capgo instance's API key list for any app_admin keys you didn't issue. Check Supabase auth logs for aal1-only sessions on MFA-enrolled accounts.
Included because
MFA bypass; persistent credential minting; affects production OTA delivery pipeline; CVSS 8.3; no patch available
Action
Revoke unexpected API keys, enforce network-level access controls on Edge functions, and monitor OTA channel configs for unauthorized changes until a fix is available.
Urgency
Patch immediately (mitigate now, no patch available)
Why it matters
An attacker with only a stolen password can bypass MFA, create persistent admin access, and push malicious app updates to production devices.

Evidence trail

02

CVE-2026-81799

NVD
7.5
CVSS
Patch within 24h HIGH
WooCommerceWordPressReturn Refund And Exchange For WooCommerceLinuxWindows

The "Return Refund and Exchange For WooCommerce" plugin (versions 4.6.4 and earlier) has a broken access control bug that lets unauthenticated users access functionality they shouldn't be able to reach. Details are sparse, but "unauthenticated" plus CVSS 7.5 means anyone on the internet can hit it without logging in.

Affected estate
WooCommerce store operators using the Return Refund and Exchange For WooCommerce plugin, version 4.6.4 or older
How to check
In the WordPress admin panel, go to Plugins and check the version number for "Return Refund and Exchange For WooCommerce." Any version at or below 4.6.4 is vulnerable.
Included because
unauthenticated; internet-facing; common WooCommerce plugin; CVSS 7.5
Action
Update the plugin to a version newer than 4.6.4 via the WordPress dashboard.
Why it matters
Unauthenticated attackers can bypass access controls on your WooCommerce refund/exchange workflow, potentially exposing order data or triggering unauthorized actions.

Evidence trail

03

CVE-2026-88030

NVD
8.3
CVSS
Patch this week HIGH
MongoDBMongoDB Ruby DriverLinuxWindowsMacOS

The MongoDB Ruby Driver's GridFS component doesn't properly sanitize file identifiers, so a structured input gets treated as a query filter instead of a literal ID. An authenticated user who can influence that identifier could read files they shouldn't have access to, or delete all file chunks in a GridFS bucket, making every stored file in that bucket unreadable.

Affected estate
Ruby developers and operators running applications that use the MongoDB Ruby Driver's GridFS component
How to check
Run `gem list mongo` to check the installed driver version. Search your codebase for GridFS operations (e.g., `Mongo::Grid::FSBucket`) that pass user-supplied data as file identifiers.
Included because
query injection; data exfiltration and deletion risk; CVSS 8.3; requires authentication but low complexity
Action
Upgrade the mongo gem to the latest patched version and add input validation to ensure GridFS identifiers are literal values.
Why it matters
An authenticated user could read arbitrary files from your GridFS bucket or wipe all stored file chunks, causing data loss.

Evidence trail

04

CVE-2026-88029

NVD
8.3
CVSS
Patch this week HIGH
MongoDBPyMongoMongoDB Python DriverLinuxWindowsMacOS

Same class of bug as the Ruby Driver issue, but in the MongoDB Python Driver (PyMongo). A structured file identifier gets interpreted as a query filter in the GridFS component. An authenticated user who controls that identifier can read files beyond the intended target, delete all file chunks in a bucket, or rename a different file than intended.

Affected estate
Python developers and operators running applications that use PyMongo's GridFS component
How to check
Run `pip show pymongo` to check the installed version. Search your codebase for `gridfs.GridFS` or `gridfs.GridFSBucket` calls that accept user-supplied identifiers.
Included because
query injection; data exfiltration and deletion risk; CVSS 8.3; requires authentication but low complexity
Action
Upgrade PyMongo to the latest patched version and validate that file identifiers are simple literal values before passing them to GridFS operations.
Why it matters
An authenticated user could exfiltrate arbitrary files, destroy stored data by deleting chunks, or rename the wrong file in your GridFS bucket.

Evidence trail

05

CVE-2026-88025

NVD
8.3
CVSS
Patch this week HIGH
MongoDBMongoDB C# Driver.NETWindowsLinux

The MongoDB C# Driver has the same GridFS query injection bug as its Ruby and Python counterparts. A structured file identifier gets treated as a query condition instead of a literal value. An authenticated user who can influence that identifier may read unauthorized files, delete all chunks in a GridFS bucket, or rename a file other than the intended target.

Affected estate
C#/.NET developers and operators running applications that use the MongoDB C# Driver's GridFS component
How to check
Check your installed MongoDB.Driver NuGet package version in your project file or via `dotnet list package`. Search for `GridFSBucket` usage where identifiers originate from user input.
Included because
query injection; data exfiltration and deletion risk; CVSS 8.3; requires authentication but low complexity
Action
Upgrade the MongoDB.Driver NuGet package to the latest patched version and ensure file identifiers are validated as literal values before use.
Why it matters
An authenticated user could read, delete, or rename arbitrary files in your GridFS bucket through a crafted identifier.

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →