Executive brief
capgo is an npm package providing backend API endpoints for managing organizational access and roles. An authenticated user with basic member-level permissions can bypass role rank checks to invite external users as organization administrators, gaining full control over apps, billing, and team members. This allows low-privileged insiders to escalate to administrative control over the entire organization.
Technical details
The vulnerability is an improper privilege management flaw in the validateInvite() function within supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint fails to compare the inviter's role rank against the requested role; it only guards org_super_admin behind the org.update_user_roles permission, allowing org_member users (who hold only org.invite_user) to invite users as org_admin or org_billing_admin. When the invited account accepts via POST /private/accept_invitation, role binding is created using Supabase's service-role key, which bypasses database-level rank enforcement triggers (prevent_role_binding_priority_escalation and check_org_user_privileges). An authenticated user with org_member role can exploit this with no additional user interaction required. The fix, merged in PR #3096, adds rank comparison logic before permitting elevated role invitations and was shipped in capgo version 12.261.0 on 2026-08-26.
Affected products
- Cap-go capgo through 12.207.1
Timeline
- 2026-08-27: disclosed
- 2026-08-26: patched: Fix merged in PR #3096 and shipped in capgo 12.261.0
- 2026-09-10: advisory