CVE-2026-100613

Executive Summary

CVE-2026-100613 is an improper authorization vulnerability in capgo.app, an over-the-air (OTA) update platform for Capacitor apps, affecting all versions through the current release with no patch available. The flaw allows a former member of a source organization to retain channel permission overrides after an app transfer, enabling them to modify a destination-owned channel via the PostgREST API and direct the /updates endpoint to serve an attacker-selected application bundle to devices. With a CVSS score of 5.3, the impact is primarily integrity-focused, potentially delivering malicious or unauthorized application code to end-user devices.

Technical Analysis

The vulnerability resides in the transfer_app() database function, which is responsible for migrating an app—along with its channels, versions, and related records—to a destination organization. Critically, this function does not delete or revalidate existing rows in the channel_permission_overrides table. As a result, a user who held a legitimate channel permission override while a member of the source organization retains that override after the transfer, even though they no longer have membership or any RBAC (Role-Based Access Control) binding in the destination organization.

The root cause is a failure to enforce authorization state transitions during an ownership transfer. When an app is transferred, the associated permission overrides remain in the database as stale records. These overrides were never designed to outlive the organizational context in which they were granted. Because the transfer_app() function lacks the logic to purge or revalidate them, the overrides persist and continue to be honored by the system.

The attack surface is the PostgREST API, which exposes the underlying database operations. An attacker who previously held an override can authenticate with their own JWT—still valid as a general user—and directly interact with the PostgREST API to invoke operations that leverage the stale override. This allows them to modify a destination-owned channel to point at a different bundle. The /updates endpoint, which serves OTA updates to Capacitor apps, then distributes this attacker-selected application version to devices.

This vulnerability is classified as CWE-863 (Incorrect Authorization). The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093) only validates organization membership when an override is created or updated; it does not address overrides that become stale as a result of an app transfer. Consequently, the fix is insufficient to close this attack vector.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/Target Identification: An attacker identifies a target organization that uses capgo.app for OTA updates and has undergone an app transfer. The attacker must have been a former member of the source organization and held a channel permission override prior to the transfer. Knowledge of the transfer event and the specific app/channel identifiers is required.

2. Triggering the Flaw: The attacker authenticates to the PostgREST API using their own valid JWT. Because the stale override remains in channel_permission_overrides, the API honors the override and permits the attacker to perform actions on the destination-owned channel despite lacking membership or RBAC binding in the destination organization. The vulnerability-class mechanism is an authorization bypass via stale permission records.

3. Payload/Execution Method: The attacker leverages the stale override to modify the destination-owned channel to point at a different bundle. This is done by issuing API calls that update the channel's bundle reference. The specific API endpoints and parameters are not detailed in the available description; the attack relies on the standard PostgREST API surface exposed by capgo.app.

4. Post-Exploitation Impact: Once the channel is repointed, the /updates endpoint serves the attacker-selected application version to devices that check for updates. This can result in the distribution of malicious or unauthorized code to end-user devices, potentially leading to further compromise, data exfiltration, or arbitrary code execution on client devices depending on the nature of the application and the attacker's payload.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, with a base score of 5.3 (Medium). The attack is network-accessible (AV:N) but requires high complexity (AC:H) and low privileges (PR:L), with no user interaction (UI:N). The scope is unchanged (S:U). There is no impact on confidentiality (C:N), high impact on integrity (I:H), and no impact on availability (A:N).

The primary business impact is the potential compromise of the software supply chain for Capacitor-based mobile applications. An attacker can inject arbitrary application versions into the update stream, affecting all devices that receive updates from the compromised channel. This can lead to widespread malware distribution, data breaches, or reputational damage. The blast radius is limited to the specific app and channel that the attacker can manipulate via the stale override, but once updates are served, the impact extends to all end-user devices consuming that channel. Affected systems include the capgo.app platform, the PostgREST API, and any Capacitor apps relying on the affected update channels. Given the lack of a patch, all deployments are vulnerable.

Detection Guidance

Sigma Rule

title: Stale Channel Permission Override Abuse via PostgREST API
id: 8f4b2c1e-3a5d-4f7b-9c8e-1d2f3a4b5c6d
status: experimental
description: Detects unauthorized modification of a channel after app transfer, likely exploiting stale channel_permission_overrides.
author: Threat Intelligence Team
date: 2026-05-12
logsource:
  product: capgo
  service: postgrest
detection:
  selection:
    http.method: 'PATCH'
    http.url|contains: '/channel'
    http.url|contains: 'bundle'
  condition: selection
falsepositives:
  - Legitimate administrative updates to channel bundles by authorized users.
level: high

YARA Rule

rule CVE_2026_100613_Stale_Override_Abuse
{
    meta:
        description = "Detects attempts to exploit stale channel permission overrides in capgo.app"
        author = "Threat Intelligence Team"
        date = "2026-05-12"
        reference = "CVE-2026-100613"
        severity = "medium"
    strings:
        $s1 = "channel_permission_overrides" ascii wide nocase
        $s2 = "transfer_app" ascii wide nocase
        $s3 = "/updates" ascii wide nocase
        $s4 = "PostgREST" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100613 - Capgo Stale Channel Permission Override Exploitation Attempt"; flow:to_server,established; http.method; content:"PATCH"; http.uri; content:"/channel"; http.uri; content:"bundle"; reference:cve,CVE-2026-100613; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by user.id
  [http where http.request.method == "PATCH" and http.request.uri contains "/channel" and http.request.uri contains "bundle"]
  [http where http.request.uri contains "/updates" and http.response.status_code == 200]

Splunk SPL Query

index=web_logs sourcetype=nginx:access
| search method=PATCH uri="*/channel*" uri="*bundle*"
| stats count by src_ip, user_agent, uri, status
| where count > 0

Wazuh OSSEC Rule

<group name="capgo,">
  <rule id="100613" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">PATCH</field>
    <field name="http.url">/channel</field>
    <field name="http.url">bundle</field>
    <description>CVE-2026-100613: Potential exploitation of stale channel permission override in capgo.app</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Audit all channel_permission_overrides records associated with apps that have undergone a transfer. Manually remove any overrides that reference users who are no longer members of the destination organization.
   • Restrict access to the PostgREST API to only trusted networks or users where possible. Implement additional authorization checks at the API gateway level to verify organization membership before honoring any channel permission override.
   • Monitor for anomalous PATCH requests to channel resources, especially those modifying bundle references, and correlate with user membership status.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor the capgo.app repository and security advisories for an official fix.
   • The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093) does not address this vulnerability and should not be considered a complete remediation.
   • Once a patch is released, update capgo.app to the fixed version immediately. Validate that the patch includes logic to purge or revalidate channel_permission_overrides during transfer_app() operations.

3. Long-term Hardening:

   • Implement database triggers or stored procedures that automatically delete or invalidate permission overrides when an app transfer occurs.
   • Enforce the principle of least privilege for all database functions and ensure that authorization checks are performed at every layer (API, database, and application logic).
   • Conduct regular audits of permission-related tables to detect stale or orphaned records.
   • Adopt a robust RBAC model that ties permissions to organizational membership and automatically revokes them upon membership changes.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100613
• GitHub Security Advisory GHSA-626c-p6fq-3whq (related, not a complete fix): https://github.com/advisories/GHSA-626c-p6fq-3whq (returned 404 — verify manually)
• capgo.app Official Website: https://capgo.app
• CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.