A database function called transfer_app() copies an app, its channels, and related records to a destination organization without removing or revalidating existing channel_permission_overrides. As a result, a former member of the source organization keeps an override that still applies to the destination organization’s channel. When that user authenticates to the PostgREST API with a valid JWT they can modify the channel to point at an attacker‑selected bundle. The /updates endpoint then serves that malicious bundle to devices, effectively delivering arbitrary code. The flaw is a classic example of the correct weakness identifier CWE-863, Authorization Bypass Through Boolean Logic. The impact is that an attacker can cause devices to receive and run software that they did not approve, leading to data loss or exposure on those devices.

The CAP‑GO platform capgo.app, which provides over‑the‑air updates for Capacitor apps, is affected in all versions up to and including the current release. No patch is available at the time of publication, so all deployed instances remain vulnerable.

The CVSS score is 6.0, indicating medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the PostgREST API, requiring a legitimate JWT belonging to a former organization member. Although an exploit is not publicly disclosed, the flaw provides a straightforward path for an attacker to alter the bundle served to devices, enabling remote code execution or malicious updates.