Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The row‑level security policies that allow organization admins to insert or update rows only verify that the caller has admin rights in the target organization; they do not verify a pending invitation, acceptance of an invite token, or that the target user has performed any action. As a result, an authenticated user who is an admin of an organization can INSERT or UPDATE org_users rows to add any existing public.users account as an active member with user_right="admin", bypassing the invitation and role‑assignment workflow. In testing a user with no prior access to an organization could, after such a direct insert, read the organization and its apps and pass check_min_rights, demonstrating a direct privilege escalation path.

All versions of Capgo (capgo.app) are affected. The vulnerability is present in the latest release of the application and no patch was available at the time of publication.

The CVSS score of 8.7 places the vulnerability in the High category and indicates that the impact is limited to administrative privileges within a specific organization. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through authenticated organization admin access; an attacker must first be granted or obtain admin rights in an org, after which they can exploit the API to elevate privileges. The absence of an external exploitation record in KEV suggests that it has not yet been widely used in the wild, but the design flaw presents an easy path for a malicious admin to convert any existing user account into an administrator of the organization.