Cap-go capgo.app up to 12.127.4 :binding_id improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Cap-go capgo.app up to 12.127.4. This affects an unknown function of the file /private/role_bindings/:binding_id. Performing a manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-100629. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cap-go capgo.app up to 12.127.4. It has been classified as problematic. This affects an unknown functionality of the file /private/role_bindings/:binding_id. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. The summary by CVE is:

Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-100629 since 09/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 12.127.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Cap-go

Name

• capgo.app

Version

• 12.127.0
• 12.127.1
• 12.127.2
• 12.127.3
• 12.127.4

Website

• Product: https://github.com/Cap-go/capgo.app/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion