Backend
Monthly
Privilege escalation in the Capgo Backend npm package (@capgo/backend) before 12.127.5 allows an authenticated attacker who already holds the org_admin role (priority rank 90) to demote org_super_admin role bindings (rank 95) down to a lower-privileged role such as org_member (rank 75) through the PATCH /private/role_bindings/:binding_id endpoint. Because the handler fails to verify the rank of the role currently bound to the target - and the prevent_last_super_admin_binding_delete safeguard fires only BEFORE DELETE, not on UPDATE - the attacker can strip every super administrator from the organization, leaving it without a super admin and enabling further governance/integrity abuse. Authentication with high privileges is required (CVSS vector PR:H), scope is limited to the attacker's own organization, and no public exploit has been identified at time of analysis; this is a bounded privileged-insider authorization defect rather than a remote unauthenticated compromise.
Privilege escalation in the Capgo Backend npm package (@capgo/backend) before 12.127.5 allows an authenticated attacker who already holds the org_admin role (priority rank 90) to demote org_super_admin role bindings (rank 95) down to a lower-privileged role such as org_member (rank 75) through the PATCH /private/role_bindings/:binding_id endpoint. Because the handler fails to verify the rank of the role currently bound to the target - and the prevent_last_super_admin_binding_delete safeguard fires only BEFORE DELETE, not on UPDATE - the attacker can strip every super administrator from the organization, leaving it without a super admin and enabling further governance/integrity abuse. Authentication with high privileges is required (CVSS vector PR:H), scope is limited to the attacker's own organization, and no public exploit has been identified at time of analysis; this is a bounded privileged-insider authorization defect rather than a remote unauthenticated compromise.