Capgo CVE-2026-100613

Exploitation requires all of: (1) the attacker previously held a legitimate channel_permission_override as a member of the source organization; (2) an admin executed the transfer_app() operation moving the app, channels, and versions to a destination organization; (3) the attacker retains a valid authenticated JWT (PR:L) to call the PostgREST API. Limiting factors: it only affects deployments that actually use Capgo's cross-organization app-transfer feature, the attacker must have been a prior override-holder, and impact is confined to integrity (repointing a channel to serve a different bundle) - no data disclosure or service outage. No user interaction is needed. The condition maps to the vendor's AT:P attack requirement.

This is a genuine but bounded authorization flaw (CWE-863), not a high-CVSS-but-hollow issue nor a top-tier emergency. The vendor CVSS 4.0 vector (6.0, AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N) is internally consistent with the description: network-reachable via the PostgREST API, requires an authenticated JWT (PR:L), and is integrity-only (VI:H) with no confidentiality or availability impact. The AT:P (attack requirement) correctly captures that exploitation is not universally reachable - it depends on a prior legitimate override plus an app transfer having occurred. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals point to a targeted, precondition-dependent issue rather than mass exploitation. The most important aggravating factor is that NO patch is available at time of publication and the prior fix (PR #3093 / GHSA-626c-p6fq-3whq) is explicitly incomplete - it validates membership on override create/update but does not purge overrides made stale by transfer_app(). Net: real priority for any org that uses Capgo's app-transfer feature between organizations, but low urgency for the broader population given niche deployment and precondition gating.

A user legitimately holds a channel_permission_override while a member of Source Org. An admin later transfers the app (with its channels and versions) to Destination Org via transfer_app(), which fails to revalidate or delete the stale override. The former member - now with no membership or RBAC binding in Destination Org - uses their own authenticated JWT against the PostgREST API to repoint the destination-owned channel at an attacker-chosen bundle, so the /updates endpoint delivers an attacker-selected application version to end-user devices. No public POC is identified in the provided data.