Capgo EUVD-2026-75413

Exploitation requires the attacker to hold an existing authenticated org_member account (or any account with the org.invite_user permission) within the target Capgo organization, plus control over an external email address to receive and accept the crafted invitation. The target organization must be running capgo.app ≤ 12.207.1. Completely unauthenticated external attackers cannot exploit this - initial org membership is a hard prerequisite (CVSS PR:L). The database triggers prevent_role_binding_priority_escalation and check_org_user_privileges provide no compensating control because the service-role key used during acceptance bypasses them entirely. No non-default configuration is required; the vulnerable endpoint is part of the standard org-management API.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects severity: any authenticated org_member can escalate a controlled external account to org_admin over the network with no special configuration or complexity. The dual failure - missing rank check at the application layer and service-role key bypass at the database layer - nullifies both defensive tiers simultaneously, making the flaw particularly clean to exploit. EPSS data is absent from the available intelligence, so quantitative exploitation probability cannot be assessed. KEV status is negative and no public proof-of-concept has been identified, which moderates urgency but should not be relied upon given the straightforward exploitation path. Real-world risk is highest for capgo organizations that grant org.invite_user to contractors, customers, or other partially trusted parties.

An attacker who has obtained a legitimate org_member account (e.g., via a normal invitation to join a project) sends a crafted authenticated POST to /private/invite_new_user_to_org requesting the org_admin role for an external email address they control. Because validateInvite() never checks whether the org_member's rank permits granting org_admin, the invitation is accepted; the attacker then accepts it from their controlled external account via /private/accept_invitation, where ensureOrgMembership uses the Supabase service-role key to apply the binding, bypassing all database-level privilege checks and granting permanent org_admin access. No public exploit code is identified at time of analysis.