Row-Level Security Flaw in Capgo App Heavyweight Update Platform

CVE-2026-100616

What is CVE-2026-100616?

The capgo.app platform, utilized for over-the-air updates for Capacitor apps, has a vulnerability concerning its row-level security UPDATE policy on the public.orgs table. Specifically, organization admins can exploit this policy to update all rows, including sensitive fields such as customer_id, which links to internal billing processes. This oversight allows a user holding the necessary permissions to manipulate billing information improperly, potentially transitioning an organization from a valid paid plan to an unpaid state. The issue arises when admins send unauthorized updates directly to Supabase PostgREST, bypassing stricter controls designed for billing permissions. As of the advisory, no patch had been released to mitigate this risk.

References