CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
An authenticated org_admin can demote super admins due to missing rank checks, potentially removing all super administrators from an organization.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100629?
CVE-2026-100629 is a high-severity missing authorization vulnerability in Cap-go capgo.app, published on 26 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.
Weakness: CWE-863
Which versions are affected by CVE-2026-100629?
How do I fix CVE-2026-100629?
No fix has been published for CVE-2026-100629 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100629 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100629 exists.
Sources
Also known as GHSA-54mj-q77q-xwx5, GHSA-56rm-j3fv-2h9m.