CVE-2026-88863
Deferred Deferred - Pending Action

Privilege Escalation in Capgo App via Role Invitation Bypass

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88863
EUVD
EUVD-2026-75413

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo to 12.207.1 (inc)
capgo capgo 12.207.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88863 is a privilege escalation vulnerability in the Capgo application (npm package capgo) up to version 12.207.1. It allows an authenticated user with org.invite_user permission (e.g., org_member) to invite another user as org_admin or org_billing_admin by bypassing role rank checks in the POST /private/invite_new_user_to_org endpoint. The flaw exists because the validateInvite() function does not compare the caller's role rank against the requested role.

Detection Guidance

To detect this vulnerability, check if your Capgo application version is 12.207.1 or earlier. Use commands like 'npm list capgo' or inspect package.json to verify the installed version. If the version is vulnerable, look for unauthorized role assignments in admin logs or audit trails.

Impact Analysis

An attacker can exploit this to gain full administrative control over the organization's apps, channels, members, and billing. This includes creating, modifying, or deleting resources, managing user permissions, and accessing sensitive data without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access and control over sensitive data, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. It may result in data breaches, unauthorized modifications, and lack of audit trails.

Mitigation Strategies

Immediately update the Capgo application to version 12.261.0 or later. Review recent user role assignments for unauthorized admin or billing admin roles. Revoke any suspicious elevated permissions and monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart