Executive brief
Capgo, a platform for managing app updates, contains a flaw in how it handles the transfer of application ownership between organizations. An attacker with basic account access can bypass the official transfer process to move an application to a new organization while leaving sensitive version data accessible to the original organization. This creates a 'split-brain' state where multiple parties may have unauthorized access to application data, potentially leading to data leaks or unauthorized modifications.
Technical details
An authorization bypass exists in Capgo's implementation of PostgREST where the 'public.apps.owner_org' field can be directly patched by a user with low privileges. This bypasses the intended 'transfer_app()' PL/pgSQL workflow which is designed to atomically update ownership across multiple tables (apps, app_versions, channels, etc.) and log the event. By directly updating only the primary app record, an attacker creates a 'split-brain' state: the new organization gains control of the app record, but the old organization's API keys retain access to the 'app_versions' data because those records were not updated. This violates the single-owner invariant and allows residual cross-organization access to version-layer data. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD