Cap-go Capgo.app Channel Permission transfer_app permission

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Cap-go Capgo.app. Impacted is the function transfer_app of the component Channel Permission. This manipulation causes permission. This vulnerability is registered as CVE-2026-100613. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in Cap-go Capgo.app (affected version unknown). Affected by this vulnerability is the function transfer_app of the component Channel Permission. The manipulation with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect integrity. The summary by CVE is:

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in `channel_permission_overrides`. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-100613 since 09/26/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/26/2026). The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Cap-go

Name

• Capgo.app

Website

• Product: https://github.com/Cap-go/capgo.app/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion