CVE-2026-88863 capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
An authenticated user can invite others with elevated roles, leading to full administrative control over the organization's resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88863?
CVE-2026-88863 is a high-severity vulnerability in Cap-go capgo.app, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.
Weakness: CWE-269
Which versions are affected by CVE-2026-88863?
How do I fix CVE-2026-88863?
No fix has been published for CVE-2026-88863 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-88863 being exploited?
There is no known exploitation of CVE-2026-88863 in the wild and no public exploit code.
Sources
Also known as GHSA-7g7p-fxx8-4wm8, GHSA-9758-4f33-587j.