Privilege Escalation in Capgo App Affecting User Role Assignments

CVE-2026-88863

What is CVE-2026-88863?

The capgo.app npm package through version 12.207.1 contains a vulnerability that allows authenticated users with limited permissions, such as org.invite_user, to escalate their privileges by inviting unauthorized external users as org_admin or org_billing_admin. This occurs because the validateInvite() function does not adequately validate the inviter's role against the requested role during the invitation process. When the invited user accepts the invitation, their role is assigned using the Supabase service-role key, leading to potential unauthorized access to sensitive organizational resources. This critical flaw was addressed in pull request #3096, which enhances role validation measures.

References