Cap-go capgo.app up to 12.207.1 invite_new_user_to_org.ts validateInvite privileges management

Summaryinfo

A vulnerability was found in Cap-go capgo.app up to 12.207.1. It has been declared as critical. Impacted is the function validateInvite of the file supabase/functions/_backend/private/invite_new_user_to_org.ts. Such manipulation leads to privileges management. This vulnerability is traded as CVE-2026-88863. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Cap-go capgo.app up to 12.207.1 and classified as critical. Affected by this issue is the function validateInvite of the file supabase/functions/_backend/private/invite_new_user_to_org.ts. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-88863 since 09/10/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/10/2026). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cap-go

Name

• capgo.app

Version

• 12.207.0
• 12.207.1

Website

• Product: https://github.com/Cap-go/capgo.app/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion