Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-88863— capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org

Quick assessment

Affected
Cap-go capgo.app
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是这段漏洞描述的中文翻译： CapGo 应用（npm 包 ）在版本 12.207.1 及之前的版本中，在 的 函数中，未将调用者的角色等级与所请求的角色进行比对。 端点在邀请 时仅要求 权限，因此，仅持有 权限的已认证用户（例如 ）可以将外部用户邀请为 或 。当被邀请的账户通过 接受邀请时， 会使用 Supabase 服务角色密钥创建角色绑定，从而绕过了 和 数据库触发器。这导致权限提升，使得攻击者能够获得对组织中应用、频道、成员和账单的完全管理控制。该问题已通过拉取请求 #3096 得到修复，该修改在允许提升

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88863

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
Source: CVE Program / CVE List V5
Vulnerability Description
capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cap-go capgo.app 0 ~ 12.207.1 -

II. Public POCs for CVE-2026-88863

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88863

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-88863 (2)

Same Patch Batch · Cap-go · 2026-09-10 · 5 CVEs total

CVE-2026-88864 9.1 CRITICAL Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
CVE-2026-88862 8.8 HIGH Capgo API Key Manager Authentication Bypass via x-limited-key-id
CVE-2026-88861 8.3 HIGH Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
CVE-2026-88860 6.3 MEDIUM Capgo Authorization Bypass via Stale Channel Permission Overrides

IV. Related Vulnerabilities

Same product: capgo.app
Same vendor: Cap-go
Same weakness: CWE-269

V. Comments for CVE-2026-88863

No comments yet

Leave a comment