CVE-2026-100623
Received Received - Intake

Capgo Supabase Membership Privilege Escalation

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...)); they do not require a pending invitation in tmp_users, acceptance of an invite token via /private/accept_invitation, any action by the target user, or the membership/role-consistency and anti-escalation checks enforced by the RBAC role-binding path. As a result, an authenticated user who is an admin of an organization can INSERT or UPDATE org_users rows directly to add any existing public.users account as an active member of that organization with user_right="admin", bypassing the invitation and role-assignment workflow entirely. In testing, an account with no prior access to the organization or its apps could, after such a direct insert, read the organization and app and pass check_min_rights. All versions are affected and no patch was available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100623
EUVD
EUVD-2026-87718

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo *-*
capgo capgo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Capgo allows an authenticated organization admin to bypass the normal invitation and role-assignment process by directly writing to the public.org_users table via Supabase PostgREST. The row-level security policies only check if the caller is an org admin but do not verify pending invitations, token acceptance, or user actions. This enables an admin to grant admin privileges to any existing user without their knowledge or consent.

Impact Analysis

An attacker with admin rights in an organization could exploit this to grant themselves or others admin privileges without the target user's involvement. This could lead to unauthorized access to sensitive data, privilege escalation, and control over the organization's applications. Even users with no prior access could gain full control of the organization.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's access control requirements. It undermines role-based access controls and audit trails, potentially resulting in non-compliance with these regulations due to unauthorized privilege escalation and data exposure.

Mitigation Strategies

Disable direct write access to the public.org_users table via PostgREST and review all existing org_users entries for unauthorized admin assignments. Implement stricter row-level security policies to enforce proper membership validation and RBAC checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart