capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org (CVE-2026-88863) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-88863

capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org

Answer in brief

CVE-2026-88863 records a Unknown severity vulnerability in capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org. The current sources do not mark it as known exploited. The current feed maps Cap-go/capgo.app (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 10, 2026Updated Sep 10, 2026Source checked Sep 10, 2026First seen by HOL Sep 10, 2026Material review Sep 10, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Cap-go/capgo.app (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Cap-go/capgo.appgeneric	0	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Cap-go/capgo.app.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 10, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.

Quoted source text, attributed separately from HOL analysis.