The vulnerability allows an organization administrator who normally lacks billing‑related privileges to modify the organization's internal Stripe customer pointer by exploiting a row‑level security policy that incorrectly permits updates on the entire row of the public.orgs table. Changing the value of customer_id to null or an invalid entry causes plan and billing checks, which rely on this pointer, to fail and results in the organization being treated as having an unpaid or no‑plan status. This effectively downgrades paid users to a free tier or disables service functionality, representing a loss of service availability and potential revenue impact for the affected organization.

All released versions of Cap-go’s capgo.app over‑the‑air update platform prior to the issuance of a fix are affected. The functionality is tied to the public.orgs table accessed via Supabase PostgREST and the library supplied by Cap-go:capgo.app.

The CVSS base score of 7 indicates a moderate severity vulnerability. With a normal authenticated administrator’s permissions the attacker can directly request an update through Supabase PostgREST, a path that is not protected by additional application‑level checks. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Consequently, the potential for exploitation depends largely on the presence of a direct PostgREST endpoint and an attacker’s ability to craft an authenticated request; the breach leads to service disruption and loss of paid features.