Capgo versions prior to 12.128.2 allow organization administrators to assign organization‑scoped RBAC roles to an application scope without checking that the role scope is compatible. The flaw also permits assigning such roles to pending invitees. This bypass enables an attacker with access to the org admin interface to seed high‑privilege bindings that persist after invite acceptance, thereby granting unauthorized privileged actions at the app level. The weakness is classified as CWE‑266, Privilege‑Escalation Through Confusing Role or Permission Levels.

Capgo, product Capgo. All installations running any version earlier than 12.128.2 are affected. The problem is limited to the org admin side of the application and does not require specific OS or hardware platforms.

The CVSS score of 8.7 indicates high severity. No EPSS score is currently available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through use of the Capgo management API or web interface by an org admin or an attacker who gains such privileges. Because the flaw can be exercised remotely via authenticated requests, the exploitation conditions are relatively straightforward for any compromised or malicious org admin account. Given the high magnitude of potential privilege escalation, the risk to affected deployments is significant.