CVE-2026-100613

Name of the Vulnerable Software and Affected Versions capgo.app (affected versions not specified)

Description The transfer app() database function fails to delete or revalidate existing rows in channel permission overrides when transferring an app, its channels, versions, and related records to a destination organization. This allows a user who had a channel permission override in the source organization to retain that override after the transfer, despite having no membership or Role-Based Access Control (RBAC) binding in the destination organization. An attacker can use an authenticated JSON Web Token (JWT) against the PostgREST API to modify the destination-owned channel to point to a different bundle, leading the /updates endpoint to serve an unauthorized application version to devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.