CVE-2026-100613: capgo.app Authorization Bypass via Stale Channel Permission Overrides

Published Sep 26, 2026
·
Updated

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the transferapp() database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in channelpermissionoverrides. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer.

Affected Software

1 affected component
Capgo capgo.app

Event History

Sep 26, 2026
CVE Published
via MITRE·01:22 PM
Data Sourced
via MITRE·01:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Organizations are exposed if they transfer an app to another organization while a former source-organization member has an existing channel permission override for that app. The affected user must retain a valid authenticated JWT and can then act without membership or an RBAC binding in the destination organization.

2

What does an attacker need to exploit it?

The attacker must have legitimately held a channel permission override before the app transfer and must be able to authenticate with their own JWT to the PostgREST API. Exploitation also requires modifying the transferred channel to reference an attacker-selected bundle.

3

How can I determine whether an app transfer left stale access behind?

Review channel_permission_overrides associated with apps that were transferred between organizations. Identify overrides belonging to users who are no longer members of, and have no RBAC binding in, the destination organization.

4

What can be done while no patch is available?

After each app transfer, remove or revalidate existing channel permission overrides for the transferred app, especially those assigned to users from the source organization. Review transferred channels to ensure they point only to intended bundles.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203