RBAC Privilege Escalation in Capgo Before 12.128.2

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2. It allows organization administrators to assign organization-scoped Role-Based Access Control (RBAC) roles at the application scope without checking if the role scope is compatible. This flaw also applies to users who have been invited but have not yet accepted the invitation.

Attackers can exploit this by pre-seeding malformed high-privilege role bindings that remain effective even after the invitee accepts the invitation. As a result, users who should have low privileges can perform unauthorized high-privilege actions within the application.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized privilege escalation within the application. Users who are supposed to have limited access can gain high-level privileges, allowing them to perform sensitive or administrative actions they are not authorized to do.

This can result in data breaches, unauthorized changes to application settings or data, and potentially compromise the security and integrity of the organization’s systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privilege users to escalate their privileges and perform unauthorized privileged actions within the application by exploiting improper RBAC role assignments.

Such unauthorized access and privilege escalation can lead to violations of security and privacy requirements mandated by common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data.

If exploited, this vulnerability could result in unauthorized data access or modification, potentially causing non-compliance with these regulations due to failure in enforcing proper role-based access controls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade Capgo to version 12.128.2 or later, where the issue has been patched.

Additionally, review and audit any existing RBAC role assignments at the application scope, especially those assigned to pending invitees, to ensure no malformed high-privilege bindings exist.

Restrict organization administrators from assigning organization-scoped roles at the application scope until the system validates role scope compatibility.

Useful 0 Not Useful 0