Description

Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-26T14:16:44.117Z",
  "pubdate": "2026-09-26T14:16:44.117Z",
  "executiveSummary": "Capgo versions before 12.127.5 contain an improper authorization flaw within the PATCH /private/role_bindings/:binding_id endpoint, leading to privilege manipulation.\nThe vulnerability allows an authenticated user with an org_admin role to demote higher-privileged accounts, specifically those with the org_super_admin designation.\nBy bypassing role hierarchy checks during update operations, an attacker can effectively strip an organization of its super administrators, resulting in a denial-of-service for administrative functions.\nThis vulnerability is categorized as an authorization bypass. Successful exploitation requires an authenticated session with at least org_admin privileges.\nThe risk is critical as it facilitates unauthorized administrative state modification and potential organizational lockout.\nThe flaw originates from a lack of rank validation for the target role during the update process and the absence of integrity checks in the backend database triggers for update operations.",
  "technicalDetails": "The vulnerability resides in the backend handler for the PATCH /private/role_bindings/:binding_id endpoint within the Capgo application. The security flaw stems from an incomplete authorization logic implementation during role assignment modifications.\nWhile the handler correctly validates that the requested new role's priority rank does not exceed the caller's own rank, it fails to perform a comparison against the rank of the role currently assigned to the target binding. This oversight creates a blind spot where an org_admin (rank 90) can modify a binding held by an org_super_admin (rank 95).\nThe attack flow proceeds as follows: 1) The authenticated attacker identifies an existing binding ID associated with a high-privilege target (org_super_admin). 2) The attacker issues a PATCH request to /private/role_bindings/:binding_id, supplying a payload that reassigns the target's role to a lower-privileged role (e.g., org_member). 3) Because the application fails to verify the current role's rank against the requester's rank during an update, the request is processed by the server.\nCrucially, the database integrity is compromised because the prevent_last_super_admin_binding_delete trigger is scoped exclusively to DELETE operations. It does not validate or block role demotion during UPDATE operations. Consequently, an attacker can systematically demote all super administrators within an organization.\nThis behavior leaves the organization in a state where no user holds the org_super_admin privilege, effectively locking out all administrative management capabilities for that environment. The flaw affects all versions of Capgo prior to 12.127.5. The impact is significant as it demonstrates a failure to maintain consistent authorization state across different CRUD operations and a lack of parity between application-level authorization and database-level integrity constraints."
}