CVE-2026-88863

capgo.app (npm package capgo) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/ backend/private/invite new user to org.ts. The POST /private/invite new user to org endpoint only requires the org.update user roles permission for org super admin invitations, so an authenticated user holding only the org.invite user permission (e.g., an org member) can invite an external user as org admin or org billing admin. When the invited account accepts the invitation via POST /private/accept invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent role binding priority escalation and check org user privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.