The vulnerability in capgo.app's transfer_app() function involves improper handling of channel_permission_overrides during app transfers between organizations. Specifically, the function transfers an app and its related records without deleting or revalidating existing channel permission overrides. Consequently, users who had channel permission overrides in the source organization retain those overrides after the transfer, despite lacking membership or RBAC bindings in the destination organization. These former members can use their authenticated JWT against the PostgREST API to modify the destination organization's channels, causing the /updates endpoint to serve malicious application versions. A previous fix (PR #3093) that validated organization membership when creating or updating overrides does not address stale overrides resulting from app transfers. No patch is available as of the publication date.

An attacker who was formerly a member of the source organization can retain channel permission overrides in the destination organization after an app transfer. This unauthorized access allows them to modify channels to point to attacker-selected application versions, potentially distributing malicious updates to devices. The vulnerability impacts integrity but not confidentiality or availability.

No official patch or fix is available at the time of publication. Users should monitor vendor advisories for updates. The previously proposed fix does not address stale overrides from app transfers, so additional manual review or temporary access controls may be necessary until a patch is released.