CVE-2026-100629: Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the orgadmin role (rank 90) can therefore change an orgsuperadmin binding (rank 95) to a lower-privileged role such as orgmember (rank 75). Because the preventlastsuperadminbindingdelete database trigger fires only BEFORE DELETE and not on UPDATE, an orgadmin can demote every orgsuperadmin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.
Other sources
Capgo (npm package @capgo/backend) before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the orgadmin role (rank 90) can therefore change an orgsuperadmin binding (rank 95) to a lower-privileged role such as orgmember (rank 75). Because the preventlastsuperadminbindingdelete database trigger fires only BEFORE DELETE and not on UPDATE, an orgadmin can demote every orgsuperadmin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
capgo/capgo.app backendto a version that resolves this vulnerability.Fixed in 12.127.5 - Upgrade
Upgrade
@capgo/backendto a version that resolves this vulnerability.Fixed in 12.127.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the org_admin role can exploit it. The vulnerable endpoint allows that user to modify a binding currently assigned to an org_super_admin, despite the higher rank of the existing role.
What is the practical impact on an organization?
An org_admin can change org_super_admin bindings to lower-privileged roles, including org_member. By doing this for every super administrator, they can leave the organization with no org_super_admin account.
Are installations running the fixed release affected?
No. The issue is fixed in Capgo backend version 12.127.5; versions before 12.127.5 are affected.
What should be done if an immediate upgrade is not possible?
Restrict org_admin access to trusted users, since org_admin is the role identified as capable of exploiting the vulnerable PATCH endpoint. Review role bindings for unexpected demotions of org_super_admin accounts and ensure at least one intended super administrator remains.