CVE-2026-88863

CVE-2026-88863 is an improper privilege management flaw (CWE-269) in the Capgo (capgo.app) backend, in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts, which fails to compare the caller's role rank against the role being requested. An authenticated user holding only the org.invite_user permission (for example an org_member) can call POST /private/invite_new_user_to_org and invite an external user as org_admin or org_billing_admin, because the endpoint only requires the org.update_user_roles permission for such invitations. When the invited account accepts via POST /private/accept_invitation, ensureOrgMembership writes the role binding using the Supabase service-role key, bypassing the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers that would normally cap role elevation. An attacker who controls the invited account thereby gains full administrative control over the organization's apps, channels, members, and billing (CVSS 4.0: 8.6, network attack vector, low privileges required). Any Capgo organization running versions through 12.207.1 is affected; there is no evidence of in-the-wild exploitation or a public proof of concept, and the flaw is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.

What to do: Upgrade the capgo package/backend to a release containing the fix from pull request #3096 (i.e., a version newer than 12.207.1) and confirm the exact patched version with the vendor; hosted capgo.app tenants should watch for vendor-side remediation. In the meantime, audit all Capgo organizations for members holding org_admin or org_billing_admin roles that were added via invitations (especially invitations sent by users below those ranks) and remove any unexpected role bindings. Consider restricting the invitation permission (org.invite_user) to trusted roles until the fix is applied.