# CVE-2026-100616: capgo.app authorization bypass in organization billing settings

Source: https://junglewise.ai/threats/cve-2026-100616-capgo-app-is-an-over-the-air-update-platform-for-capacitor-apps  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100616 · Severity: medium · CVSS 5.5 · Published 2026-09-26

capgo.app is an over-the-air update platform for mobile app developers. An organization admin can exploit a database permission flaw to bypass billing controls and corrupt or delete the organization's billing account link, causing the platform to stop enforcing paid subscription plans and allowing unlimited use without payment.

Technologies: [Cap-go Capgo.App](https://junglewise.ai/threats/technologies/cap-go-capgo-app). Vendors: [Cap-go](https://junglewise.ai/threats/vendors/cap-go).

## Quick answers

**Is CVE-2026-100616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100616 being exploited in the wild.

**How severe is CVE-2026-100616?** Medium severity, with a CVSS score of 5.5, published 26 September 2026.

**Which products and versions are affected?** Cap-go Capgo.App all versions prior to fix.

**Is there a fix for CVE-2026-100616?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100616 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-100616?** Check whether you run Cap-go Capgo.App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in row-level security (RLS) policies: the public.orgs table UPDATE policy permits org.update_settings role to modify the entire row including the internal customer_id column, despite the official API endpoint allowlisting only safe fields. An authenticated org admin without org.update_billing permission can send a direct Supabase PostgREST query to null or corrupt customer_id, breaking billing and plan enforcement that depends on this field.

## Affected products

- Cap-go capgo.app all versions prior to fix

## Timeline

- 2026-09-26: disclosed: Advisory published
- 2026-09-08: other: GitHub GHSA-qp5h-v7x3-53cq published

## References

- [https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qp5h-v7x3-53cq](https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qp5h-v7x3-53cq)
- [https://www.vulncheck.com/advisories/capgo-app-authentication-bypass-via-postgrest-customer-id-mutation](https://www.vulncheck.com/advisories/capgo-app-authentication-bypass-via-postgrest-customer-id-mutation)

## Related threats

- [Capgo authorization bypass in org_users table](https://junglewise.ai/threats/cve-2026-100623-capgo-capgo-app-exposes-the-legacy-membership-table-public-org)
- [capgo.app bundle deletion bypass via edge cache](https://junglewise.ai/threats/cve-2026-100622-capgo-app-through-12-129-0-fails-to-verify-deletion-status-when)
- [Cap-go capgo.app authorization bypass in channel permissions](https://junglewise.ai/threats/cve-2026-100617-cap-go-capgo-app-fails-to-validate-that-principals-in-channel)
- [Cap-go capgo.app privilege escalation via API key rotation](https://junglewise.ai/threats/cve-2026-100615-cap-go-capgo-app-before-12-267-1-fails-to-validate-target-api)