Capgo versions prior to 12.128.2 have an authorization flaw in the transfer_app() operation that neglects to update the deploy_history.owner_org field when moving an application from one organization to another. The bug allows an attacker who can trigger a transfer to keep access to deployment history records in the source organization or to deprive the destination organization of its expected deployment records. This flaw represents an improper authorization weakness (CWE-285).

The vulnerability affects the Capgo application server released by Capgo:Capgo. All installations running a version older than 12.128.2 are susceptible. Upgrading to 12.128.2 or newer eliminates the flaw.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need authenticated access to the transfer_app() interface; the flaw can be exploited by supplying a transfer request and then benefiting from the missing owner_org update. Because the flaw is tied to a specific API call, the likelihood of exploitation remains unclear but could be significant in environments where organization boundaries are heavily enforced.