Executive brief
Capgo is a mobile app deployment platform that manages application versions and team membership. An authenticated organization administrator can bypass the normal invitation workflow to directly add any existing user as an admin member of their organization, gaining unauthorized access to apps and data without the target user's consent or action.
Technical details
The vulnerability exists in Supabase PostgREST row-level security (RLS) policies on the public.org_users table. The "Allow org admin to insert" and "Allow org admin to update" policies only check that the caller has admin rights via check_min_rights(), but fail to enforce the required invitation acceptance, RBAC role-binding validation, or anti-escalation checks. An authenticated org admin can directly INSERT or UPDATE org_users rows to add any existing user account with user_right="admin", completely bypassing the /private/accept_invitation flow.
Affected products
- Cap-go capgo.app all
Timeline
- 2026-09-26: disclosed
- 2026-09-08: advisory: GHSA-w349-9mc3-8c5x published