Authorization Bypass in Capgo.app Due to Stale Permission Overrides

CVE-2026-100613

What is CVE-2026-100613?

Capgo.app, designed for over-the-air updates for Capacitor applications, contains a vulnerability where the transfer_app() function fails to remove or revalidate existing channel permission overrides during an app transfer. This flaw enables a former member of the source organization to retain their permissions, even without current membership, potentially allowing unauthorized modifications of the destination organization’s application channels. Attackers can exploit this by using their own validated JWT tokens, leading to the possibility of redirecting app updates to versions controlled by malicious actors.

References