Authentication Bypass Vulnerability in Capgo Application Exposing User Data

CVE-2026-100623

What is CVE-2026-100623?

The Capgo application inadequately secures its legacy membership table 'public.org_users,' making it susceptible to authentication bypass through Supabase PostgREST. This flaw allows an authenticated organization admin to manipulate user entries directly, without proper authorization checks like pending invitations or acceptance tokens. Consequently, an unauthorized user can gain admin rights by exploiting this vulnerability, enabling them to access the organization's information and capabilities without following established membership protocols. All versions of the Capgo application are affected, and no fix is currently available.

References