CVE-2026-100629
Received Received - Intake

Authorization Bypass in Capgo Backend

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100629
EUVD
EUVD-2026-87723

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
capgo capgo_app_backend to 12.127.5 (exc)
capgo capgo_backend to 12.127.5 (exc)
capgo capgo_backend to 12.116.69 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100629 is an authorization flaw in the Capgo backend (versions <= 12.116.69) where the PATCH /private/role_bindings/:binding_id endpoint fails to check the rank of the currently bound role. An org_admin (rank 90) can demote an org_super_admin (rank 95) to org_member (rank 75) by bypassing privilege checks. The PATCH handler only validates the new role's rank against the caller's privilege but ignores the existing binding's rank. Additionally, the prevent_last_super_admin_binding_delete trigger only activates on DELETE, not UPDATE, allowing org_admins to remove all super_admin privileges, locking out critical functions.

Detection Guidance

To detect this vulnerability, check if your Capgo backend version is <= 12.116.69. Use commands like 'npm list capgo.app' or inspect package.json to verify the installed version. If the version is vulnerable, look for unauthorized role binding changes in logs, particularly PATCH requests to /private/role_bindings/:binding_id that modify org_super_admin bindings.

Impact Analysis

An attacker with org_admin access could demote all org_super_admins, leaving the organization without super_admin privileges. This could disrupt critical functions like billing management, app deletion, and overall system administration. The vulnerability enables privilege escalation and potential lockout of essential roles.

Compliance Impact

This vulnerability could lead to unauthorized privilege changes, violating access control requirements in GDPR (Article 32) and HIPAA (45 CFR § 164.308(a)(4)). Loss of super_admin privileges may disrupt compliance-related functions like audit logging, data access controls, and system integrity, potentially resulting in non-compliance.

Mitigation Strategies

Immediately upgrade Capgo backend to version 12.127.5 or later. Review recent role binding changes for unauthorized demotions of org_super_admin users. Implement additional monitoring for PATCH requests to /private/role_bindings/:binding_id endpoints to detect suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart