CVE-2026-100616 Details

A vulnerability exists in capgo.app, an over-the-air update platform for Capacitor apps, in all versions prior to a fix. The issue arises from the row-level security UPDATE policy on the public.orgs table, which allows an organization admin with the org.update_settings permission to update the entire row, including the internal billing pointer column customer_id. The official organization update endpoint only allows a limited set of editable fields and excludes customer_id. Additionally, the private Stripe billing route requires the org.update_billing permission. As a result, an authenticated organization admin without org.update_billing can null or corrupt the organization's Stripe customer pointer by sending a direct update through Supabase PostgREST. This manipulation causes plan and billing checks that rely on orgs.customer_id to fail, disrupting the organization's paid plan status and creating potential billing issues.

A fix has been implemented in a pull request that adds a trigger to prevent client-side updates to internal columns like 'customer_id', ensuring that only 'org.update_billing' or service-role permissions can make such changes.