The vulnerability is an authorization flaw in the Capgo backend that allows authenticated users with the org_admin role to modify role bindings of other users. The PATCH /private/role_bindings/:binding_id endpoint validates the new role’s priority but does not check the current role’s rank. An org_admin can therefore demote an org_super_admin to a lower privilege. The change also bypasses the prevent_last_super_admin_binding_delete trigger, which only runs before DELETE, meaning an org_admin could remove the last remaining super administrator and leave an organization with no super admin. As a result, the system’s administrative control can be overwritten by a lesser‑privileged user, undermining the organization’s governance and potentially allowing further malicious activity. This is a classic privilege escalation flaw (CWE‑267, CWE‑863).

Capgo backend (capgo.app) versions 12.127.4 and earlier, running in any environment where the patch endpoint is exposed. The issue was fixed in the 12.127.5 release.

The CVSS score of 7 indicates a high likelihood to cause significant impact. While the EPSS metric is not available, the attack requires legitimate org_admin credentials, which can be obtained by an internal user or through credential compromise. The exploitation path uses the normal authenticated API, so it is surface‑level internal to the organization’s web service. The high CVSS rating and the ability to demote the last super administrator elevate the risk for organizations that have not applied the 12.127.5 fix. Whether the vulnerability is listed in KEV does not change the need for timely remediation, but its inclusion in a standard CVE table underscores that you should act promptly.