Technical impact
In the capgo npm package, the invite_new_user_to_org function fails to verify that an inviter’s role rank is at least equal to the role they are attempting to grant. This deficiency allows an authenticated org_member, which only has org.invite_user permission, to create invitations that elevate the new user to org_admin or org_billing_admin. When the new user accepts, the system binds the role using a Supabase service‑role key, circumventing database triggers designed to prevent role priority escalation. The result is full administrative control over the organization’s apps, channels, members, and billing. The flaw is categorized as CWE‑269, and the CVSS score of 8.6 indicates a high severity vulnerability.
Affected Systems
The vulnerability affects the Cap-go:capgo.app product, specifically the capgo npm package version 12.207.1 and earlier. The issue resides in the supabase/functions/_backend/private/invite_new_user_to_org.ts module of the package.
Risk and Exploitability
The high CVSS score and absence of mitigations in the database triggers mean that an attacker who can authenticate as a legitimate org_member can exploit this flaw. The likely attack vector is the POST /private/invite_new_user_to_org endpoint, which only requires org_invite_user permission. Because the exploit does not rely on external vulnerabilities and uses legitimate API calls, its feasibility is high. No KEV listing or EPSS value is available, but the severity alone warrants immediate attention.
