CVE-2026-100629
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but never checks the rank of the role currently bound to the target binding, allowing an org_admin (rank 90) to demote an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75).
Risk Assessment
An org_admin user can demote every org_super_admin, leaving the organization with no super administrator. This can lead to loss of administrative control and disruption of organization management.
Recommendation
Update Capgo to version 12.127.5 or later. Until the update, consider restricting role binding modifications by org_admin users.
Other vulnerabilities in Capgo
See all- CVE-2026-88863High
The npm package `capgo` (through version 12.207.1) fails to compare the caller's role rank against the requested role in validateInvite(). A user holding only the org.invite_user permission can invite an external user as org_admin or org_billing_admin, and accepting the invitation creates the role binding while bypassing database protection triggers.
- CVE-2026-56335Medium
An authorization bypass vulnerability in Capgo before version 12.128.2 allows write-scoped API keys to directly modify protected channel configuration fields via PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can alter sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.
- CVE-2026-56329Medium
A vulnerability in Capgo before version 12.128.2 is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, leading to preview misrouting and denial of preview access for victim applications.
- CVE-2026-56312Medium
A vulnerability in Capgo before version 12.128.2 in the accept_invitation endpoint creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.
- CVE-2026-56309Medium
A vulnerability in Capgo before version 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.
- CVE-2026-56279High
A vulnerability in Capgo before version 12.128.2 discloses information via the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
- CVE-2026-56298Medium
The vulnerability in Capgo before version 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded metadata.
- CVE-2026-56293Medium
A vulnerability in Capgo before version 12.128.2 stems from an authorization flaw in the transfer_app() function that fails to update the deploy_history.owner_org field when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.
- CVE-2026-56283Medium
An HTML injection vulnerability in Capgo before version 12.128.2 in the organization settings endpoint allows attackers to inject malicious HTML content. By crafting payloads in the organization name field, they can redirect users to untrusted websites, enabling phishing attacks and reputational damage.
- CVE-2026-56250High
A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.
Original NVD description (English source)
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS