CVE-2026-100623 in Capgo
Summary
by MITRE • 09/26/2026
Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...)); they do not require a pending invitation in tmp_users, acceptance of an invite token via /private/accept_invitation, any action by the target user, or the membership/role-consistency and anti-escalation checks enforced by the RBAC role-binding path. As a result, an authenticated user who is an admin of an organization can INSERT or UPDATE org_users rows directly to add any existing public.users account as an active member of that organization with user_right="admin", bypassing the invitation and role-assignment workflow entirely. In testing, an account with no prior access to the organization or its apps could, after such a direct insert, read the organization and app and pass check_min_rights. All versions are affected and no patch was available at the time of publication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Capgo involves a critical misconfiguration within the Supabase PostgREST interface that exposes the legacy membership table public.org_users to direct manipulation by authenticated users with administrative privileges in an organization. This architectural flaw allows for the bypassing of established security controls designed to manage user roles and permissions through proper invitation workflows. The core issue stems from the row-level security policies applied to this specific database table, which are insufficiently restrictive regarding how membership changes are validated. Specifically, the policies labeled Allow org admin to insert and Allow org admin to update only verify that the caller possesses administrative rights within the target organization by invoking a function check_min_rights with an admin parameter. This verification step is narrowly scoped and fails to enforce broader organizational security protocols required for role assignment.
The technical flaw lies in the absence of critical validation steps during direct database writes via PostgREST. When an administrator uses this exposed endpoint, the system does not require that there be a pending invitation record in the tmp_users table, nor does it mandate acceptance of an invite token through the designated /private/accept_invitation endpoint. Furthermore, the vulnerability ignores any required action by the target user and bypasses membership role-consistency checks as well as anti-escalation mechanisms typically enforced by the standard RBAC role-binding path. This means that the integrity of the access control model is compromised because the database layer accepts changes without validating them against the application-level business logic that governs secure onboarding and permission escalation processes.
The operational impact of this vulnerability is severe, as it enables an authenticated user who holds administrative rights in one organization to arbitrarily add any existing public.users account as an active member with full administrator privileges within that same organization. This bypasses all invitation workflows, allowing for immediate privilege escalation without the consent or knowledge of the target user. In practical testing scenarios, accounts that previously had no access to the organization or its associated applications were able to gain such access simply by performing a direct insert operation on the org_users table. Once these unauthorized administrative entries are created, the attacker can successfully pass subsequent check_min_rights validations for both the organization and its apps, effectively gaining unrestricted control over organizational resources and data.
This vulnerability aligns with CWE-269 Improper Privilege Management, as it allows an actor to elevate their privileges beyond what is intended by the system design. It also relates to CWE-732 Incorrect Permission Assignment for Critical Resource, since the configuration of row-level security policies fails to restrict access appropriately based on contextual requirements like pending invitations or user consent. From a threat intelligence perspective, this behavior corresponds to ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials and administrative privileges to move laterally within an environment by creating new authorized accounts that bypass standard provisioning controls. The exploitation of this flaw effectively undermines the principle of least privilege and allows for unauthorized lateral movement and data exfiltration capabilities within the affected organization's scope.
Mitigation strategies must focus on restricting direct database access through PostgREST for sensitive membership tables until proper application-level validation can be enforced. Ideally, all modifications to user roles and memberships should be routed exclusively through the application’s API endpoints that implement comprehensive checks including invitation status, token acceptance verification, and anti-escalation logic. If immediate remediation is not possible via code changes, implementing strict firewall rules or network policies to block direct PostgREST access to the public.org_users table can serve as a temporary compensating control. Additionally, auditing existing org_users records for unauthorized administrative entries created through this vector is essential to restore integrity to the organization’s access control model. Since no patch was available at the time of publication, organizations must rely on these architectural and network-level mitigations to prevent exploitation until an official fix addressing the row-level security policy deficiencies is released by Capgo.