Executive brief
capgo is an over-the-air update platform that manages application deployments to mobile devices. When an app is transferred between organizations, the platform fails to remove permission overrides that former members had established, allowing them to retain unauthorized control over which app versions devices receive. An attacker with a former membership can authenticate and change the deployed version to one of their choosing, affecting all devices using that app's update channel.
Technical details
The transfer_app() database function moves app ownership to a destination organization but does not clean up or revalidate channel_permission_overrides rows, leaving stale overrides in place. A former source-org member retains their authenticated JWT and can use it to satisfy channel.update_settings and channel.promote_bundle permission checks via the surviving override, even though they lack any RBAC binding in the destination organization. This allows an unauthenticated attacker with prior membership to call the /updates endpoint and cause devices to fetch a modified application version.
Affected products
- Cap-go capgo all versions up to and including current release at time of publication
Timeline
- 2026-09-26: disclosed
- 2026: other: Pending fix PR #3093 does not resolve the transfer scenario