capgo.app (npm package capgo) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles permission for orgsuperadmin invitations, so an authenticated user holding only the org.inviteuser permission (e.g., an orgmember) can invite an external user as orgadmin or orgbillingadmin. When the invited account accepts the invitation via POST /private/acceptinvitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the preventrolebindingpriorityescalation and checkorguserprivileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.