# CVE-2026-88863

## Summary

- **CVE ID:** CVE-2026-88863
- **Severity:** HIGH
- **CVSS Score:** 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-269
- **Published:** Sep 10, 2026
- **Last Modified:** Sep 10, 2026

## Description

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.

## Affected Products

- Cap-go — capgo.app (0)

## References

- [CNA](https://github.com/Cap-go/capgo.app/security/advisories/GHSA-7g7p-fxx8-4wm8)
- [CNA](https://www.vulncheck.com/advisories/capgo-app-through-12.207.1-privilege-escalation-via-invite-new-user-to-org)

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._