CVE-2026-100613: capgo.app Authorization Bypass via Stale Channel Permission Overrides
capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the transferapp() database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in channelpermissionoverrides. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations are exposed if they transfer an app to another organization while a former source-organization member has an existing channel permission override for that app. The affected user must retain a valid authenticated JWT and can then act without membership or an RBAC binding in the destination organization.
What does an attacker need to exploit it?
The attacker must have legitimately held a channel permission override before the app transfer and must be able to authenticate with their own JWT to the PostgREST API. Exploitation also requires modifying the transferred channel to reference an attacker-selected bundle.
How can I determine whether an app transfer left stale access behind?
Review channel_permission_overrides associated with apps that were transferred between organizations. Identify overrides belonging to users who are no longer members of, and have no RBAC binding in, the destination organization.
What can be done while no patch is available?
After each app transfer, remove or revalidate existing channel permission overrides for the transferred app, especially those assigned to users from the source organization. Review transferred channels to ensure they point only to intended bundles.