CVE-2026-100621 describes an improper access control flaw in Capgo's capgo.app affecting all versions. The enforcement of content locks in the database schema exempts app_versions rows with a previous storage_provider value of 'r2-direct', leaving key columns mutable. Additionally, the /updates endpoint does not exclude these 'r2-direct' versions, allowing an attacker with a Capgo API key and bundle write/upload permissions to create or maintain a bundle version in this state, assign it to a channel, and modify critical metadata fields such as checksum and session_key via direct PostgREST requests. This effectively bypasses prior post-upload immutability protections.

An attacker with valid API credentials and bundle upload permissions can alter delivery-critical metadata of app bundles, potentially causing devices to receive manipulated or tampered update information. This undermines the integrity of the update process and could lead to distribution of unauthorized or corrupted content.

No patch or official fix is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, restrict API key permissions to the minimum necessary and carefully audit bundle version states, especially those in the 'r2-direct' state, to mitigate risk.