CVE-2026-100613
Received Received - Intake

Privilege Escalation via Stale Channel Permissions in capgo.app

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in `channel_permission_overrides`. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100613
EUVD
EUVD-2026-87708

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo to 0 (inc)
capgo capgo.app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100613 is an authorization bypass flaw in capgo.app, an OTA update platform for Capacitor apps. The vulnerability occurs in the transfer_app() function, which moves apps and related data to a new organization without deleting stale channel permission overrides. Former members retain access to modify channels in the new organization despite losing membership, allowing them to redirect updates to malicious versions.

Impact Analysis

If you use capgo.app for OTA updates, attackers could exploit this flaw to push unauthorized app versions to your users' devices. This could lead to malware distribution, data breaches, or service disruption. Devices may install compromised updates silently, affecting end-user security without their knowledge.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data or systems. GDPR may be breached if user data is exposed through malicious updates. HIPAA could be impacted if healthcare apps are compromised, leading to unauthorized data access or transmission.

Mitigation Strategies

Review all channel permission overrides in the channel_permission_overrides table for stale entries. Remove any overrides where the user no longer has valid membership or RBAC bindings in the destination organization. Audit the /updates endpoint logs for unauthorized channel modifications or unexpected version redirections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart