Capgo EUVD-2026-43224

Exploitation requires that the attacker was previously granted the super_admin role in the target Capgo organization and that their user account/session remains active after the role binding was deleted; the stale org_users.user_right value is what preserves access. The attacker then invokes the delete_non_compliant_bundles and count_non_compliant_bundles RPCs directly. Limiting factors: the attacker must be an authenticated user (PR:L) who at some point held super_admin - a fully external, never-privileged attacker cannot trigger this - and the target must be running a version before 12.128.2 where a demotion actually occurred without clearing user_right. Organizations that never demote super_admins, or that fully deactivate accounts on offboarding, are not exposed.

The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H, score 7.2 High) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high integrity and availability impact and low confidentiality impact - consistent with a former insider bulk-deleting data via authenticated RPCs. This is not a mass-scannable internet threat: exploitation is gated on the attacker having previously been granted super_admin in the target organization (PR:L), so the realistic threat model is a malicious or compromised former administrator rather than an anonymous remote attacker. No EPSS score, KEV listing, or POC was provided, so exploitation probability signals are absent; the absence of these should be read as 'unknown,' not 'low risk.' There is no SSVC decision data in the input. The primary conflict to verify is the confidentiality rating: the count/enumerate RPC implies some data exposure, which the vendor scored as VC:L, while the true business impact is the destructive VI:H/VA:H bulk deletion - priority should be driven by the integrity/availability loss to organizations that perform administrator demotions.

An organization revokes a contractor's super_admin role in Capgo, believing their destructive access is gone. Because org_users.user_right was never cleared, the contractor's still-valid account continues to call the count_non_compliant_bundles RPC to enumerate targets and then delete_non_compliant_bundles to wipe non-compliant bundles across the whole organization, causing service and integrity damage. No public POC was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or tooling is needed once the stale privilege exists.