Is CVE-2026-100613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100613 being exploited in the wild.

How severe is CVE-2026-100613?

Medium severity, with a CVSS score of 5.3, published 26 September 2026.

Which products and versions are affected?

Cap-go Capgo all versions up to and including current release at time of publication.

Is there a fix for CVE-2026-100613?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100613 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-100613?

Check whether you run Cap-go Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100613: capgo App Transfer Authorization Bypass via Stale Channel Overrides

CVE-2026-100613 · Severity: medium · CVSS 5.3 · Published 2026-09-26

capgo is an over-the-air update platform that manages application deployments to mobile devices. When an app is transferred between organizations, the platform fails to remove permission overrides that former members had established, allowing them to retain unauthorized control over which app versions devices receive. An attacker with a former membership can authenticate and change the deployed version to one of their choosing, affecting all devices using that app's update channel.

Technologies: Cap-go Capgo. Vendors: Cap-go.

Quick answers

Is CVE-2026-100613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100613 being exploited in the wild.
How severe is CVE-2026-100613?: Medium severity, with a CVSS score of 5.3, published 26 September 2026.
Which products and versions are affected?: Cap-go Capgo all versions up to and including current release at time of publication.
Is there a fix for CVE-2026-100613?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100613 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-100613?: Check whether you run Cap-go Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The transfer_app() database function moves app ownership to a destination organization but does not clean up or revalidate channel_permission_overrides rows, leaving stale overrides in place. A former source-org member retains their authenticated JWT and can use it to satisfy channel.update_settings and channel.promote_bundle permission checks via the surviving override, even though they lack any RBAC binding in the destination organization. This allows an unauthenticated attacker with prior membership to call the /updates endpoint and cause devices to fetch a modified application version.

Affected products

Cap-go capgo all versions up to and including current release at time of publication

Timeline

2026-09-26: disclosed
2026: other: Pending fix PR #3093 does not resolve the transfer scenario

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.