CVE-2026-100613 - Vuln Watch

判定

概要: アプリ移転時に、channel_permission_overrides の既存行が削除・再検証されず、移転元で付与された権限が移転後も残る問題です。
影響: 移転元の元メンバーが、自身の認証済みJWTで移転先のチャンネルを別のバンドルに変更し、デバイスに攻撃者が選んだアプリバージョンを配信させる可能性があります。
対象: capgo.app の全バージョン（説明文では公開時点の現行リリースまで。affected 情報ではバージョン 0 から全バージョンが対象）。
対策: 公開時点でパッチはありません。
判定: AV:N / PR:L / UI:N（CNA・CVSS 4.0）／該当する攻撃能力なし
出典: CVE.org: CVE-2026-100613

GitHub Security Advisory (GHSA-6mj9-x3ww-rpj9)

VulnCheck Advisory: capgo.app Authorization Bypass via Stale Channel Permission Overrides

出所	版	AV / PR / UI	ベクトル	出所側の更新日時
CNA（採用）	4.0	AV:N / PR:L / UI:N	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	2026-10-01 02:20
CNA	3.1	AV:N / PR:L / UI:N	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N	2026-10-01 02:20

認証回避・ CNA の説明文
Using their own authenticated JWT against the PostgREST API
シェル取得・ CNA の説明文
such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices.
root 取得・ CNA の説明文
such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices.

モデル gpt-6-luna ・プロンプト 2026-10-10 ・ 2026-10-13 05:53 ・入力 SHA-256 40065dc66cc0

PostgreSQL — 説明文で一致（AI の判定: 影響を受けるか非該当）

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting or revalidating existing rows in `channel_permission_overrides`. As a result, a user who legitimately held a channel permission override while a member of the source organization retains that override after the transfer, even though they have no membership and no RBAC binding in the destination organization. Using their own authenticated JWT against the PostgREST API, such a former member can modify the destination-owned channel to point at a different bundle, causing the /updates endpoint to serve an attacker-selected application version to devices. The previously proposed fix for GHSA-626c-p6fq-3whq (PR #3093), which validates organization membership when an override is created or updated, does not remove overrides that became stale as a result of an app transfer.