Threats tagged 'ghsa-455x-98vm-63r8'

CVE-2026-100616 is an authorization vulnerability in capgo.app, an over-the-air update platform for Capacitor apps. The flaw allows an organization admin with the org.update_settings permission to update the entire row in the public.orgs table, including the internal billing pointer customer_id, by bypassing the official update endpoint restrictions. This can corrupt or nullify the Stripe customer pointer, causing billing and plan checks to fail and resulting in the organization being treated as unpaid or without a plan. No patched version is currently available.