CVE-2026-100629

Name of the Vulnerable Software and Affected Versions Capgo (capgo.app backend) versions prior to 12.127.5

Description An authorization flaw exists in the 'PATCH /private/role bindings/:binding id' endpoint. The handler verifies that the priority rank of a newly assigned role does not exceed the caller's rank, but it fails to check the rank of the role currently bound to the target binding. This allows an authenticated user with the org admin role (rank 90) to change an org super admin binding (rank 95) to a lower-privileged role, such as org member (rank 75). Since the prevent last super admin binding delete database trigger only executes before a delete operation and not during an update, an org admin can demote all org super admin users, potentially leaving the organization without a super administrator.

Recommendations Update to version 12.127.5.