Capgo Backend EUVD-2026-87723

Requires an authenticated principal holding the org_admin role (priority rank 90) within a Capgo organization, and the target organization must contain one or more org_super_admin (rank 95) role bindings to demote. Exploitation is performed via the PATCH /private/role_bindings/:binding_id endpoint of @capgo/backend versions before 12.127.5. It works against default configurations (the missing current-role rank check and the DELETE-only prevent_last_super_admin_binding_delete trigger are inherent behavior), needs no user interaction, but is limited to the attacker's own organization scope and by the high privilege prerequisite - this is a privileged-insider governance/integrity issue, not a remote unauthenticated compromise.

This is a genuine but bounded authorization defect (CWE-863) whose real-world priority is moderate, not critical. The vendor CVSS 4.0 base of 7.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L) is internally consistent: the flaw is network-reachable and low-complexity, but gated behind PR:H because the attacker must already hold the administrative org_admin role, and it produces no confidentiality loss (VC:N) - only integrity impact on role-binding state (VI:H) and a loss of super-admin governance availability (VA:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automatable exploitation. The dominant limiting factor is the PR:H prerequisite: the actor is already a trusted, high-privilege org administrator, so this is best characterized as a trust-boundary/governance-control weakness (a privileged insider can strip the organization of its super administrators) rather than an externally weaponizable escalation. No conflicting signals were found; the CVSS vector aligns with the description (authenticated, network API endpoint, integrity-focused impact).

An authenticated Capgo user holding the org_admin role (rank 90) sends a PATCH request to /private/role_bindings/:binding_id targeting an org_super_admin binding (rank 95), changing it to a lower-privileged role such as org_member (rank 75); because the handler only validates the incoming role's rank and never the currently-bound role's rank, the demotion succeeds. Repeating this against every super_admin binding leaves the organization with no super administrator, since the last-super-admin protection trigger fires only on DELETE, not UPDATE. No public exploit code was identified, and exploitation requires the attacker to already possess org_admin privileges.