capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` databa…
Medium CVSS 5.3
Summary
capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in `channel_permission_overrides`. As a result, a user who legitimately held a channel permission override while a member of the source organization r…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/Cap-go/capgo.app/security/advisories/GHSA-6mj9-x3ww-rpj9
- https://www.vulncheck.com/advisories/capgo-app-authorization-bypass-via-stale-channel-permission-overrides
Timeline
- nvd_ingest NVD