CVE-2026-100616
Received Received - Intake

Privilege Escalation in Capgo.app via Billing Pointer Manipulation

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin (a user holding org.update_settings) to update the entire row, including the internal billing pointer column customer_id. The official organization update endpoint (supabase/functions/_backend/public/organization/put.ts) allowlists only a small set of editable settings fields and excludes customer_id, and the private Stripe billing route separately requires the org.update_billing permission. By sending an update directly to Supabase PostgREST, an authenticated org admin without org.update_billing can null or corrupt the organization's Stripe customer pointer, causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior. At the time of the advisory no patched version was available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100616
EUVD
EUVD-2026-87711

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
capgo capgo.app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects capgo.app, an over-the-air update platform for Capacitor apps. It allows an organization admin with org.update_settings permission to directly modify the customer_id field in the public.orgs table via Supabase PostgREST. This bypasses intended billing controls, enabling unauthorized changes to the Stripe customer pointer. The official update endpoint and billing route restrict access to customer_id, but the row-level security policy permits broad updates, allowing corruption or nullification of billing data.

Detection Guidance

To detect this vulnerability, monitor for unauthorized modifications to the customer_id field in the public.orgs table via Supabase PostgREST. Check logs for direct UPDATE queries targeting this column by org admins without billing permissions. Use Supabase dashboard or PostgreSQL queries to audit recent changes to orgs.customer_id.

Impact Analysis

If you are an organization admin using capgo.app, an attacker with org.update_settings permission could exploit this to corrupt your billing data. This may cause your organization to appear unpaid or without a plan, disrupting access to paid features. The vulnerability can downgrade your plan status, leading to service interruptions or loss of functionality.

Compliance Impact

This vulnerability could impact compliance by disrupting billing integrity, which may affect data accuracy and accountability requirements under GDPR and HIPAA. If billing data is corrupted, organizations may fail to meet financial record-keeping obligations, leading to potential regulatory violations. The loss of plan status could also result in unauthorized access to sensitive data.

Mitigation Strategies

Immediately restrict column-level updates to customer_id in public.orgs. Implement stricter row-level security policies to prevent unauthorized modifications. Move billing state to a protected table or add triggers to block client-side changes to internal columns like customer_id.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart