Authorization Flaw in Capgo Application Backend Affects Role Management

CVE-2026-100629

What is CVE-2026-100629?

An authorization flaw in the Capgo backend prior to version 12.127.5 allows authenticated users with the org_admin role to demote users with the org_super_admin role to lower privilege roles, affecting overall organization management. This occurs because the PATCH /private/role_bindings/:binding_id endpoint does not verify the current role's priority rank when changing roles. As a result, an org_admin can potentially leave the organization without any super administrators by demoting all existing org_super_admins. This vulnerability underscores the importance of proper role verification in access management systems.

References