CVE-2026-100616

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin (a user holding org.update_settings) to update the entire row, including the internal billing pointer column customer_id. The official organization update endpoint (supabase/functions/_backend/public/organization/put.ts) allowlists only a small set of editable settings fields and excludes customer_id, and the private Stripe billing route separately requires the org.update_billing permission. By sending an update directly to Supabase PostgREST, an authenticated org admin without org.update_billing can null or corrupt the organization's Stripe customer pointer, causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior. At the time of the advisory no patched version was available.

• CWE-863

• https://github.com/Cap-go/capgo.app/security/advisories/GHSA-qp5h-v7x3-53cq
• https://www.vulncheck.com/advisories/capgo-app-authentication-bypass-via-postgrest-customer-id-mutation

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100610Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id…7.5
• CVE-2026-100611Capgo (capgo.app backend, versions ≤ 12.261.0) improperly re…6.5
• CVE-2026-100612Capgo (capgo.app) through version 12.261.0 contains an incom…7.2
• CVE-2026-100613capgo.app is an over-the-air (OTA) update platform for Capac…5.3
• CVE-2026-100614Capgo before 12.244.1 contains a cross-tenant integrity vuln…8.8
• CVE-2026-100615Cap-go capgo.app before 12.267.1 fails to validate target AP…8.8
• CVE-2026-100617Cap-go capgo.app fails to validate that principals in channe…8.8
• CVE-2026-100618Capgo (capgo.app) is affected by an authorization flaw in th…8.5
• CVE-2026-100619Capgo (capgo.app) blocks direct user inserts into the public…8.8
• CVE-2026-10062A vulnerability was determined in TRENDnet TEW-432BRP 3.10B2…9.8
• CVE-2026-100620Capgo CLI (npm package @capgo/cli) through 7.98.2 is affecte…3.8
• CVE-2026-100621Capgo (capgo.app) contains an incomplete access-control/cont…4.3