CVE-2026-100613 Details
Description
capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in `channel_permission_overrides`. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer.
A vulnerability exists in capgo.app, an over-the-air (OTA) update platform for Capacitor apps, in all versions up to the current release. The issue arises in the `transfer_app()` database function, which transfers apps and their associated channels and versions to a new organization. However, it fails to delete or revalidate existing channel permission overrides. As a result, a user who had a legitimate channel permission override in the source organization retains it after the transfer, despite lacking membership or role-based access control (RBAC) in the destination organization. This allows former members to use their authenticated JSON Web Token (JWT) to modify destination-owned channels, directing them to serve attacker-chosen application versions via the /updates endpoint. The vulnerability stems from an authorization failure during the app transfer process, where stale permission overrides are not removed, enabling unauthorized control over OTA release selections.
As of now, no patch is available for this vulnerability. However, the issue has been acknowledged and a fix is pending.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-6mj9-x3ww-rpj9 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Cap-go/capgo.app/security/advisories/GHSA-6mj9-x3ww-rpj9 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/capgo-app-authorization-bypass-via-stale-channel-permission-overrides | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cap-go capgo.app | <= 4eeb020c534294713f6e78abe3ffffb994ef6f23 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | [email protected] |
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |