CVE-2026-56257: Capgo Split-Brain Ownership Vulnerability – Authorization Bypass

Technical summary

The vulnerability exists in Capgo's PostgREST interface, which exposes the public.apps.owner_org column without sufficient authorization checks. Attackers can directly UPDATE the owner_org field, bypassing the transfer_app() function that normally handles ownership changes. This causes inconsistency: apps.owner_org reflects the new owner, but app_versions.owner_org remains unchanged. Since version access control likely depends on matching owner_org values, the old organization's service accounts retain read/write access to version records through their existing credentials, while the new organization gains control of the app metadata. This creates a privilege escalation and data retention mechanism that circumvents intended access revocation.

Business impact

Organizations using Capgo for mobile app distribution face loss of access control over their applications and versions. A disgruntled employee, compromised service account, or targeted attacker could transfer ownership of critical apps while maintaining covert access to version data and release pipelines. This enables supply-chain tampering (malicious app updates), data exfiltration, and denial of legitimate updates. Compliance frameworks (SOC 2, ISO 27001) require documented ownership and access control—split-brain scenarios create audit failures and evidence destruction concerns. Multi-tenant SaaS customers are at heightened risk if a single compromised account can affect multiple apps.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability requires network access to the PostgREST endpoint and valid authentication credentials (PR:L in CVSS vector). Self-hosted and SaaS deployments of Capgo are in scope. Organizations using Capgo as their primary mobile app distribution and versioning platform are directly impacted.

Exploitability

Exploitation requires valid user or service account credentials—no unauthenticated bypass is present. Once authenticated, the attack is straightforward: a single direct SQL UPDATE via PostgREST modifies owner_org without triggering application logic validation. No user interaction or special conditions are required (AC:L, UI:N). An attacker can execute this attack repeatedly and against multiple apps in seconds. The barrier to exploitation is low for insiders or accounts with compromised credentials; external attackers would need to obtain valid credentials through phishing or credential stuffing.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch version is expected to implement proper authorization checks that either (1) remove direct PostgREST write access to apps.owner_org, or (2) enforce application-layer validation that ensures app_versions.owner_org is atomically updated in sync with apps.owner_org. Verify the patch details against the vendor's release notes. Organizations should audit recent app ownership changes to detect unauthorized transfers and ensure that old organization API keys are revoked if ownership was modified.

Patch guidance

Deploy Capgo 12.128.2 immediately in development and staging environments to validate compatibility and confirm the fix resolves the split-brain issue. Test that ownership transfers now correctly update both apps.owner_org and app_versions.owner_org, and that old organization credentials no longer retain access to transferred apps' versions. Perform a rolling upgrade to production to avoid service disruption. After patching, review audit logs for any ownership changes that occurred between the vulnerability's public disclosure (2026-06-24) and your patch date to identify potential exploitation.

Detection guidance

Monitor PostgREST request logs for direct UPDATE statements against the apps table, especially those modifying owner_org without corresponding app_versions updates. Alert on sudden ownership changes not preceded by authenticated transfer_app() function calls. Review access logs to detect old organization API keys accessing app_versions after an app transfer event. Implement database-level audit triggers on apps.owner_org changes to capture the source user and timestamp. Query your app inventory for rows where apps.owner_org differs from the owner_org of associated app_versions—this indicates a split-brain state.

Why prioritize this

This vulnerability scores HIGH (7.1 CVSS) due to its high integrity impact and ease of exploitation by authenticated users. While it requires prior credential compromise or insider access, the consequence is severe: persistent, covert access to application distribution pipelines, which could enable supply-chain attacks affecting end users. The ability to silently transfer ownership while retaining access makes detection and forensic investigation difficult. Organizations with sensitive or widely-distributed apps should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: Network attack vector (AV:N) — exploitable over the network via PostgREST; Low attack complexity (AC:L) — direct database UPDATE is trivial; Low privilege required (PR:L) — needs valid credentials but not administrator role; No user interaction (UI:N) — fully automated attack; Unchanged scope (S:U) — impacts only the Capgo application; Low confidentiality impact (C:L) — attacker can read version metadata; High integrity impact (I:H) — attacker can modify ownership and retain access; No availability impact (A:N) — the app and versions remain functional. The high integrity rating and low barrier to exploitation drive the HIGH severity classification.

Frequently asked questions