Executive brief
capgo.app is an over-the-air update platform for mobile app developers. An organization admin can exploit a database permission flaw to bypass billing controls and corrupt or delete the organization's billing account link, causing the platform to stop enforcing paid subscription plans and allowing unlimited use without payment.
Technical details
The vulnerability is an authorization bypass in row-level security (RLS) policies: the public.orgs table UPDATE policy permits org.update_settings role to modify the entire row including the internal customer_id column, despite the official API endpoint allowlisting only safe fields. An authenticated org admin without org.update_billing permission can send a direct Supabase PostgREST query to null or corrupt customer_id, breaking billing and plan enforcement that depends on this field.
Affected products
- Cap-go capgo.app all versions prior to fix
Timeline
- 2026-09-26: disclosed: Advisory published
- 2026-09-08: other: GitHub GHSA-qp5h-v7x3-53cq published