The vulnerability in capgo.app involves the transfer_app() database function failing to delete or revalidate existing channel_permission_overrides during an app transfer between organizations. Consequently, users who had channel permission overrides in the source organization retain those overrides after the transfer, even though they lack membership or RBAC bindings in the destination organization. By authenticating with their own JWT via the PostgREST API, these former members can modify destination-owned channels to point to different bundles, causing the /updates endpoint to serve potentially malicious application versions. A prior fix addressed validation when creating or updating overrides but did not remove stale overrides resulting from app transfers. No patch is currently available.

An attacker who was previously a member of the source organization but no longer has membership in the destination organization can retain channel permission overrides after an app transfer. This allows them to modify the destination organization's channel to serve attacker-selected app versions to devices. This could lead to unauthorized code execution or deployment of malicious updates via the OTA update mechanism.

No official patch or fix is available at this time. Users should monitor vendor advisories for updates. Since the vulnerability involves stale permission overrides after app transfers, organizations should consider manual review and cleanup of channel permission overrides following transfers as a temporary mitigation until an official fix is released.