capgo.app EUVD-2026-87711

Requires an authenticated user who is an organization admin holding the org.update_settings permission but lacking org.update_billing, and requires the attacker to bypass the official organization/put.ts endpoint by issuing an UPDATE directly to the Supabase PostgREST API. The vulnerability exists because the row-level security UPDATE policy on public.orgs authorizes a full-row write instead of restricting to the allowlisted settings columns, so customer_id is writable. Limiting factors: exploitation is confined to the attacker's own organization, needs pre-existing admin-level credentials (PR:H), causes no data disclosure, and affects only billing/plan state (nulling/corrupting the Stripe pointer) rather than the broader system.

This is a genuine but modest-severity broken-authorization (CWE-863) flaw, not a high-urgency threat. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H) scores 7.0, but that HIGH rating is driven almost entirely by VA:H, which I assess as generous: the actual effect is corruption of a single billing-pointer column (customer_id) within the attacker's OWN organization, degrading paid-plan state rather than causing broad availability loss. PR:H is correct and important - exploitation requires an authenticated organization admin already holding org.update_settings, so this is an insider privilege-separation / separation-of-duties bypass (an admin acting beyond org.update_billing), not remote-unauthenticated compromise. No confidentiality impact (VC:N/C:N). There is NO EPSS score, NO CISA KEV listing, and no public exploit identified at time of analysis; exploitation requires only a direct PostgREST call, so it is technically trivial for someone who already has admin access, but the trust/privilege prerequisite sharply limits real-world risk. Note the input Tag 'Authentication Bypass' conflicts with CWE-863 and the description - this is an authorization/access-control failure, not authentication bypass. Net: real defect worth patching for billing-integrity and separation-of-duties, but low operational priority given PR:H, single-org scope, and absence of exploitation signals.

An authenticated organization admin in a Capgo tenant who holds org.update_settings but NOT org.update_billing sends an UPDATE request directly to the Supabase PostgREST API against public.orgs, bypassing the official put.ts endpoint's field allowlist, and nulls or corrupts the customer_id Stripe pointer. Because plan/billing checks trust orgs.customer_id, the organization silently drops from its valid paid-plan state to unpaid/no-plan behavior. No public exploit code is identified, but the attack is a single direct API call requiring no special tooling.