CVE-2026-100623

Executive Summary

CVE-2026-100623 is a broken authorization vulnerability in the Capgo (capgo.app) platform, which exposes its legacy public.org_users membership table directly through Supabase PostgREST. The row-level security (RLS) policies for that table only validate that the caller is an admin in the target organization and do not enforce the invitation or role-assignment workflow, allowing an authenticated organization admin to insert or update membership rows and grant full admin rights to any existing public.users account. Any organization using the affected Capgo deployment is exposed; successful exploitation results in complete compromise of organizational data and applications with a CVSS score of 8.8 (High).

Technical Analysis

The vulnerability resides in the authorization logic protecting the legacy membership table public.org_users, which is exposed via Supabase PostgREST. The table's row-level security (RLS) policies, named "Allow org admin to insert" and "Allow org admin to update", gate write operations solely on a check that the caller possesses admin rights within the target organization through the function public.check_min_rights('admin', ...). Critically, these policies do not require:

• a pending invitation in the tmp_users table,
• acceptance of an invite token via the /private/accept_invitation endpoint,
• any action by the target user being added, or
• the membership/role-consistency and anti-escalation checks that are normally enforced by the RBAC role-binding path.

Because Supabase PostgREST exposes the table directly, an authenticated user who is an admin of an organization can bypass the intended invitation and role-assignment workflow entirely. By issuing a direct INSERT or UPDATE against public.org_users, the attacker can add any existing public.users account as an active member of the organization with user_right="admin". This is a classic broken authorization flaw (CWE-863): the authorization check is insufficient because it does not validate the full set of conditions required to legitimately establish membership.

The attack surface is the PostgREST API endpoint that maps to the org_users table. No authentication bypass is needed; the attacker must already hold admin rights in at least one organization. The vulnerability is not a memory-safety issue or injection flaw; it is an access-control design defect. All versions are affected, and no patch was available at the time of publication.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker with an authenticated account on a Capgo instance identifies an organization where they already have admin rights. They enumerate the exposed PostgREST endpoint for public.org_users to confirm it is reachable and that write operations are permitted.

2. Triggering the flaw: The attacker constructs a direct INSERT or UPDATE request against the org_users table. The request includes the target organization's identifier and a chosen public.users account identifier, and sets user_right="admin". The RLS policies evaluate check_min_rights('admin', ...) and pass, because the attacker is an admin in that organization. The missing checks for pending invitations, token acceptance, or RBAC anti-escalation mean the operation succeeds.

3. Payload/execution method: The payload is a PostgREST-compatible HTTP request (e.g., POST or PATCH) targeting the org_users resource. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The request does not require any action by the target user.

4. Post-exploitation impact: After the insert, the previously unauthorized account becomes an active admin member of the organization. In testing, an account with no prior access to the organization or its apps could, after such a direct insert, read the organization and app data and pass check_min_rights. This grants full control over the organization, its applications, and potentially other members, enabling data exfiltration, further privilege escalation, and persistence.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8 (High). The attack is network-accessible (AV:N), requires low complexity (AC:L), and requires the attacker to hold low-level privileges (PR:L) — specifically, admin rights in at least one organization. No user interaction is required (UI:N), and the scope is unchanged (S:U). Confidentiality, integrity, and availability are all rated High (C:H/I:H/A:H), reflecting that an attacker can read and modify organizational and application data, and can add arbitrary users as admins.

The blast radius includes any organization on the affected Capgo deployment. Because the flaw bypasses invitation and role-consistency controls, it undermines the entire RBAC model. Business impact includes unauthorized access to sensitive organizational data, potential lateral movement to other organizations via compromised accounts, and loss of trust in the platform's access controls. The EPSS score is not yet available; CISA KEV status is NO. No public exploit code or Nuclei template exists, but the vulnerability is trivially exploitable by any authenticated admin.

Detection Guidance

Sigma Rule

title: Capgo org_users Direct Insertion or Update via PostgREST
id: 7f3a9c2e-1b4d-4e8a-9c5f-2d6e8a1b3c7d
status: experimental
description: Detects direct INSERT or UPDATE operations against the Capgo public.org_users table through Supabase PostgREST, indicating potential privilege escalation.
author: Valters IT
date: 2026-01-01
logsource:
  category: web
  product: supabase
detection:
  selection_method:
    http.method:
      - 'POST'
      - 'PATCH'
  selection_endpoint:
    http.url|contains: '/org_users'
  selection_body:
    http.request.body|contains: 'user_right'
  condition: selection_method and selection_endpoint and selection_body
falsepositives:
  - Legitimate administrative membership management if performed through the intended UI workflow
level: high
tags:
  - attack.t1078
  - cve.2026.100623

YARA Rule

rule CVE_2026_100623_Capgo_OrgUsers_PrivEsc
{
    meta:
        description = "Detects HTTP requests targeting Capgo org_users table via PostgREST"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-100623"
        severity = "high"
    strings:
        $s1 = "/org_users" ascii nocase
        $s2 = "user_right" ascii nocase
        $s3 = "check_min_rights" ascii nocase
        $s4 = "tmp_users" ascii nocase
        $s5 = "/private/accept_invitation" ascii nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100623 Capgo org_users Direct Insertion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/org_users"; http_uri; content:"user_right"; http_client_body; classtype:attempted-admin; sid:2026100623; rev:1; reference:cve,2026-100623; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

http where http.request.method in ("POST", "PATCH") and
  stringContains(http.request.uri, "/org_users") and
  stringContains(http.request.body, "user_right")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=supabase
| search (method=POST OR method=PATCH) uri="*/org_users*"
| search request_body="*user_right*"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, uri, method, status
| where status < 400
| sort - count

Wazuh OSSEC Rule

<group name="web,supabase,">
  <rule id="100623" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">POST|PATCH</field>
    <field name="http.request.uri" type="pcre2">/org_users</field>
    <field name="http.request.body" type="pcre2">user_right</field>
    <description>CVE-2026-100623: Possible Capgo org_users privilege escalation via PostgREST</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_100623,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict or disable direct write access to the public.org_users table through PostgREST. Enforce RLS policies that require a pending invitation in tmp_users and successful acceptance of an invite token via /private/accept_invitation before any membership row can be inserted or updated. Apply the same membership/role-consistency and anti-escalation checks used by the RBAC role-binding path. Audit existing org_users rows for unauthorized admin members.

2. Patch/upgrade steps: No vendor patch is available. Monitor the Capgo project for an official fix and apply it as soon as it is released. Until then, treat the deployment as vulnerable and apply compensating controls.

3. Long-term hardening: Adopt a defense-in-depth approach to authorization: never rely solely on a single privilege check for sensitive membership operations. Implement database triggers or stored procedures that enforce invitation and role-consistency invariants. Regularly review RLS policies for all exposed tables. Enforce least privilege for all API roles and monitor for anomalous PostgREST write operations.

References

1. NVD — CVE-2026-100623: https://nvd.nist.gov/vuln/detail/CVE-2026-100623
2. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
3. Capgo official website: https://capgo.app
4. Supabase PostgREST documentation: https://postgrest.org
5. CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog