CVE-2026-100617

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100613

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-100617 Cap-go capgo.app Authorization Bypass via channel_permission_overrides

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

EUVD-2026-87712

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100617 Cap-go capgo.app Authorization Bypass via channel_permission_overrides

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100617

The Cap-go capgo.app application contains an authorization bypass vulnerability due to a failure to validate that principals in channel_permission_overrides belong to the organization. Authenticated users with app or organization admin privileges can exploit this by inserting override rows with a...

CVE-2026-100613 capgo.app Authorization Bypass via Stale Channel Permission Overrides

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-100613

The capgo.app OTA update platform for Capacitor apps is vulnerable in all versions up to the current release. The transfer_app() database function fails to delete or revalidate records in channel_permission_overrides during an organization transfer. This allows a former member of a source organiz...

CVE-2026-100613 capgo.app Authorization Bypass via Stale Channel Permission Overrides

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

EUVD-2026-87708

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-100617: Missing Authorization

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100613: Incorrect Authorization

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...