EUVD-2026-40429
GHSA-j363-jrwq-xw9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable multi-tenant service abused by an authenticated org admin (PR:L, AC:L, UI:N); privilege escalation yields high CIA within the tenant with no scope change to other systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileged app actions.
AnalysisAI
Privilege escalation in Capgo before 12.128.2 lets an authenticated org admin assign org-scoped RBAC roles at the narrower app scope without any validation of scope compatibility, and to do so even for pending (not-yet-accepted) invitees. Because these malformed high-privilege bindings persist through invite acceptance, a nominally low-privilege user who accepts the invite gains unauthorized privileged app-level actions. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Capgo is an open-source live/OTA update service and Capacitor plugin used to push code updates to mobile apps; the affected component is its multi-tenant RBAC (role-based access control) authorization layer, identified by the CPE cpe:2.3:a:capgo:capgo. The flaw maps to CWE-266 (Incorrect Privilege Assignment): the role-binding logic accepts a role defined for one scope (org) and binds it at a different scope (app) without checking that the role's scope is compatible with the target. Compounding this, bindings can be created for invitees who have not yet accepted, so the authorization check that should occur at assignment time is effectively bypassed and the stale, over-privileged grant is materialized once the user joins.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, which adds validation of role-scope compatibility during assignment. Before or in addition to patching, audit existing role bindings for org-scoped roles that have been bound at app scope and revoke any malformed high-privilege grants, paying particular attention to bindings attached to pending invitations that have not yet been accepted. As an operational compensating control where immediate upgrade is not possible, restrict who holds org-admin rights and review the invite queue so that crafted bindings cannot survive to acceptance - the trade-off is added administrative overhead and slower onboarding. Refer to GHSA-55q2-p3m2-x66x (https://github.com/Cap-go/capgo/security/advisories/GHSA-55q2-p3m2-x66x) and the VulnCheck advisory for authoritative guidance.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today