CVE-2026-88863: capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
capgo.app (npm package capgo) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles permission for orgsuperadmin invitations, so an authenticated user holding only the org.inviteuser permission (e.g., an orgmember) can invite an external user as orgadmin or orgbillingadmin. When the invited account accepts the invitation via POST /private/acceptinvitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the preventrolebindingpriorityescalation and checkorguserprivileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm package capgo (capgo.app)to a version that resolves this vulnerability.Fixed in 12.207.1Patch pull request #3096 - Configuration
When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership must create the role binding using the Supabase service-role key (so it bypasses prevent_role_binding_priority_escalation and check_org_user_privileges).
Supabase database function ensureOrgMembership role binding creation method = Use Supabase service-role key to bypass prevent_role_binding_priority_escalation and check_org_user_privileges triggers
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated organization user with the org.invite_user permission can exploit it, including an org_member. The attacker does not need an existing administrative role, but can invite an external account with an elevated role.
What access can the attacker obtain after exploitation?
After the invited account accepts the invitation, it can receive org_admin or org_billing_admin privileges. This can result in administrative control over the organization's apps, channels, members, and billing.
Does accepting the invitation require a separate bypass of database protections?
No. The acceptance flow creates the role binding with the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers.
What should be reviewed to identify possible exploitation?
Review invitations created by users holding org.invite_user, especially invitations assigning org_admin or org_billing_admin roles to external accounts. Also review accepted invitations and resulting elevated role bindings for accounts whose inviter did not hold an equivalent role rank.
What remediation is identified?
The issue is addressed by pull request #3096. The change compares the inviter's role rank before allowing invitations to elevated roles.