EUVD-2026-38168
GHSA-phvp-mxhx-w4fp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Supabase API (AV:N), straightforward UPDATE once authenticated (AC:L), requires existing admin role (PR:H), no UI; full integrity/availability impact via super_admin takeover, no new confidentiality exposure beyond admin's existing reads.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to super_admin. Attackers can exploit the insufficient RLS enforcement to gain unauthorized super_admin access and compromise system security.
AnalysisAI
Privilege escalation in Capgo before 12.128.2 allows authenticated users holding the admin role to elevate themselves to super_admin by abusing a broken row-level security (RLS) policy on the org_users table. No public exploit identified at time of analysis, but a vendor patch is available and the flaw was disclosed by VulnCheck through a GitHub Security Advisory.
Technical ContextAI
Capgo is a self-hostable live-update / over-the-air update platform for Capacitor apps that uses Supabase (PostgreSQL) as its backend. Postgres Row Level Security policies are the primary authorization layer for multi-tenant Supabase apps: each row exposes a using/with check expression that decides whether the calling JWT may read or modify it. CWE-266 (Incorrect Privilege Assignment) here manifests because the RLS policy on the org_users membership table does not adequately restrict which role values an authenticated admin may assign, so the database itself permits an UPDATE that promotes the row's role column to super_admin instead of blocking it. The affected component is identified by CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* across all versions prior to 12.128.2.
RemediationAI
Vendor-released patch: Capgo 12.128.2 - upgrade self-hosted instances to 12.128.2 or later as documented in GHSA-9xqh-f26v-9c9h (https://github.com/Cap-go/capgo/security/advisories/GHSA-9xqh-f26v-9c9h). If immediate upgrade is not possible, operators can apply compensating controls at the Postgres layer by tightening the RLS policy on the org_users table to reject UPDATEs whose new role value is greater than the caller's current role (e.g. WITH CHECK (NEW.role <> 'super_admin' OR auth.jwt() ->> 'role' = 'super_admin')), or by temporarily revoking UPDATE on org_users.role from the authenticated Postgres role and channelling role changes through a SECURITY DEFINER function - the trade-off is that legitimate admin role-management workflows in the UI will break until policies are re-aligned. Auditing the org_users table for unexpected super_admin entries and rotating credentials of any account that should not hold that role is recommended before declaring the issue closed.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today