EUVD-2026-42254
GHSA-9ph8-2cv6-679j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low privileges required since attacker must be authenticated; confidentiality and integrity impact limited to deployment history records with no availability or scope-change effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.
AnalysisAI
Incomplete state management in Capgo's transfer_app() function allows low-privileged authenticated users to retain or cause loss of access to deployment history records across organizations. Specifically, the function fails to update the deploy_history.owner_org field during inter-organization application transfers in all versions before 12.128.2, creating a persistent stale authorization grant. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Capgo is an open-source live-update platform for Capacitor-based mobile applications (github.com/Cap-go/capgo) that supports multi-organization deployment pipelines. The flaw resides in the transfer_app() function, which manages ownership transitions of applications between organizations but atomically fails to update the deploy_history.owner_org field - the database column linking deployment history records to their owning organization. The root cause is classified as CWE-285 (Improper Authorization): the application does not enforce a complete, correct authorization state during a critical ownership transition. Because deploy_history.owner_org retains the source organization's identity post-transfer, access control decisions based on this field remain anchored to the previous owner, enabling residual cross-organization access. Affected versions span all Capgo releases from 0 up to but not including 12.128.2, as documented in EUVD-2026-42254.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the incomplete deploy_history.owner_org update in transfer_app(). The vendor security advisory is available at https://github.com/Cap-go/capgo/security/advisories/GHSA-854w-xj7g-prv3 and additional details are published by VulnCheck at https://www.vulncheck.com/advisories/capgo-stale-cross-organization-authorization-via-incomplete-deploy-history-update-in-transfer-app. As a compensating control prior to patching, restrict access to the application transfer feature by limiting which roles or users can initiate cross-organization transfers, reducing the population of accounts that can trigger or benefit from the stale authorization state. Additionally, audit existing deploy_history records for applications transferred between organizations prior to patching, examining owner_org fields for stale source-organization references that may represent residual unauthorized grants. The patch corrects an internal state-transition omission and is not expected to produce side effects for normal deployment operations.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today