CVE-2026-100616 - Vuln Watch

判定

概要: org.update_settings 権限を持つ組織管理者が、Supabase PostgREST を直接利用して public.orgs の行全体を更新でき、Stripe 顧客ポインター customer_id も変更できる問題です。
影響: org.update_billing 権限がなくても customer_id を消去・破損させ、組織の課金・プラン状態を有料から未払いまたはプランなしの状態にできます。
対象: capgo.app の修正前の全バージョン。アドバイザリの時点では修正版はありませんでした。
対策: 修正版はアドバイザリ時点で未提供。回避策の記載なし。
判定: AV:N / PR:H / UI:N（CNA・CVSS 4.0）／該当する攻撃能力なし
出典: CVE.org: CVE-2026-100616

GitHub Security Advisory (GHSA-qp5h-v7x3-53cq)

VulnCheck Advisory: capgo.app Authentication Bypass via PostgREST customer_id Mutation

出所	版	AV / PR / UI	ベクトル	出所側の更新日時
CNA（採用）	4.0	AV:N / PR:H / UI:N	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N	2026-10-01 02:20
CNA	3.1	AV:N / PR:H / UI:N	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H	2026-10-01 02:20

RCE ・ CNA の説明文
causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior.
認証回避・ CNA の説明文
an authenticated org admin without org.update_billing
シェル取得・ CNA の説明文
null or corrupt the organization's Stripe customer pointer, causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior.
root 取得・ CNA の説明文
null or corrupt the organization's Stripe customer pointer, causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior.

モデル gpt-6-luna ・プロンプト 2026-10-10 ・ 2026-10-13 05:53 ・入力 SHA-256 605dcd9663f6

PostgreSQL — 説明文で一致（AI の判定: 影響を受けるか非該当）

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin (a user holding org.update_settings) to update the entire row, including the internal billing pointer column customer_id. The official organization update endpoint (supabase/functions/_backend/public/organization/put.ts) allowlists only a small set of editable settings fields and excludes customer_id, and the private Stripe billing route separately requires the org.update_billing permission. By sending an update directly to Supabase PostgREST, an authenticated org admin without org.update_billing can null or corrupt the organization's Stripe customer pointer, causing plan and billing checks that trust orgs.customer_id to fail and moving the organization from a valid paid plan state to unpaid/no-plan behavior. At the time of the advisory no patched version was available.