Is CVE-2026-88863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88863 being exploited in the wild.

How severe is CVE-2026-88863?

High severity, with a CVSS score of 8.1, published 10 September 2026.

Is there a fix for CVE-2026-88863?

A patch was published on 2026-08-26: Fix merged in PR #3096 and shipped in capgo 12.261.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88863 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88863?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88863: capgo Privilege escalation in invite_new_user_to_org

CVE-2026-88863 · Severity: high · CVSS 8.1 · Published 2026-09-10

capgo is an npm package providing backend API endpoints for managing organizational access and roles. An authenticated user with basic member-level permissions can bypass role rank checks to invite external users as organization administrators, gaining full control over apps, billing, and team members. This allows low-privileged insiders to escalate to administrative control over the entire organization.

Quick answers

Is CVE-2026-88863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88863 being exploited in the wild.
How severe is CVE-2026-88863?: High severity, with a CVSS score of 8.1, published 10 September 2026.
Which products and versions are affected?: Cap-go capgo through 12.207.1.
Is there a fix for CVE-2026-88863?: A patch was published on 2026-08-26: Fix merged in PR #3096 and shipped in capgo 12.261.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88863 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88863?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper privilege management flaw in the validateInvite() function within supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint fails to compare the inviter's role rank against the requested role; it only guards org_super_admin behind the org.update_user_roles permission, allowing org_member users (who hold only org.invite_user) to invite users as org_admin or org_billing_admin. When the invited account accepts via POST /private/accept_invitation, role binding is created using Supabase's service-role key, which bypasses database-level rank enforcement triggers (prevent_role_binding_priority_escalation and check_org_user_privileges). An authenticated user with org_member role can exploit this with no additional user interaction required. The fix, merged in PR #3096, adds rank comparison logic before permitting elevated role invitations and was shipped in capgo version 12.261.0 on 2026-08-26.

Affected products

Cap-go capgo through 12.207.1

Timeline

2026-08-27: disclosed
2026-08-26: patched: Fix merged in PR #3096 and shipped in capgo 12.261.0
2026-09-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.