CVE-2026-100629

Executive Summary

CVE-2026-100629 is an authorization flaw (CWE-863, Incorrect Authorization) in the Capgo backend (capgo.app) affecting versions before 12.127.5. An authenticated user with the org_admin role (rank 90) can abuse the PATCH /private/role_bindings/:binding_id endpoint to demote org_super_admin bindings (rank 95) to lower-privileged roles, because the update handler fails to validate the rank of the currently bound role in the same way the DELETE handler does. The result is integrity impact to the organization's privilege model (I:H) and a viable route to leaving an organization with no super administrator, which impairs administrative control and recovery (A:L).

Technical Analysis

The vulnerability resides in the authorization logic of the PATCH /private/role_bindings/:binding_id handler of the Capgo backend. Role assignments are modeled as "role bindings," and each role carries a numeric priority rank: org_member = 75, org_admin = 90, org_super_admin = 95 in the examples given in the NVD description.

The handler performs a partial authorization check: it confirms that the priority rank of the newly assigned role does not exceed the caller's own rank. This prevents an org_admin from granting a role ranked above their own (e.g., assigning org_super_admin). However, the handler — unlike its DELETE counterpart — never checks the rank of the role currently bound to the target binding. This asymmetry is the core defect:

• A properly authorized deletion path presumably examines both the caller's rank and the rank of the existing binding, so an org_admin cannot delete a rank-95 binding.
• The update path only validates the incoming (new) role rank, not the target's existing role rank. An org_admin (rank 90) can therefore target an existing org_super_admin binding (rank 95) and set its role to any rank ≤ 90 — for example org_member (75).

A secondary contributing factor is a database-level control: the prevent_last_super_admin_binding_delete trigger fires only BEFORE DELETE, not on UPDATE. Because the demotion is performed through an UPDATE, the trigger's last-super-admin safeguard is never invoked. There is no equivalent BEFORE UPDATE guard described. The two weaknesses combine multiplicatively: the application-layer check is incomplete, and the database-layer backstop does not cover the update path.

Attack surface: an authenticated API endpoint (/private/ namespace suggests a privileged/internal controller scope) reachable by any holder of the org_admin role. The flaw is not memory-safety related; it is a pure logic/authorization defect, exercised entirely through well-formed requests to a documented endpoint.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (incorrect authorization) and the specific details in the NVD description.

1. Reconnaissance / target identification. The adversary authenticates to Capgo and enumerates role bindings within the target organization, identifying bindings that currently hold the org_super_admin role (rank 95). The exact endpoint used for enumeration is not specified in the source data.

2. Triggering the flaw class. Using an account holding org_admin (rank 90), the attacker issues a PATCH /private/role_bindings/:binding_id request against the identifier of an org_super_admin binding. The handler's own-rank check passes because the requested new role (org_member, rank 75) does not exceed the caller's rank (90). No check is performed against the rank of the role presently bound, so the request is accepted.

3. Payload / execution method. The operation is a standard authenticated API update of the binding's role to a lower-privileged value. The database prevent_last_super_admin_binding_delete trigger does not fire, because the operation is an UPDATE, not a DELETE, so the last-super-admin invariant is bypassed. At vulnerability-class level: missing authorization validation on a state-changing update allows modification of an object the actor should not be permitted to modify.

4. Post-exploitation impact. By repeating the PATCH against every org_super_admin binding, the org_admin can demote all super administrators to org_member (or any rank ≤ 90), leaving the organization with no operational super administrator. This constitutes a privilege-model integrity violation and a potential denial of organization-level administration, with recovery requiring out-of-band intervention (database-level correction or vendor support).

Impact Assessment

The CVSS v3.1 base score is 5.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L.

• AV:N (Network) — the endpoint is remotely reachable.
• AC:L (Low) — no unusual conditions; a valid authenticated request with permitted role rank satisfies the precondition.
• PR:H (High) — the attacker must already hold the elevated org_admin role, which substantially limits the exploitable population.
• UI:N (None) — no victim interaction required.
• S:U (Unchanged) — impact remains within the same security authority scope.
• C:N (None) / I:H (High) — no confidentiality impact, but high integrity impact: role bindings, the central authorization state, are modified in ways not intended by policy.
• A:L (Low) — administrative availability is degraded, particularly the ability to manage the organization, rather than a full loss of service.

Blast radius: any organization on a Capgo backend version prior to 12.127.5 that permits org_admin accounts. The immediate victim set is the org_super_admin population, but the durable business impact is loss of trusted administrative control over the tenant. This is a governance and privilege-integrity incident rather than a data-breach class event. Internal-only exposure is likely, which reduces external attack surface, but a malicious or compromised insider org_admin (or an attacker who has already escalated to org_admin) gains an efficient, low-noise path to strip the tenant of its highest authority roles.

Detection Guidance

The precise request shape (headers, body schema) is not specified in the available data; detections below target behavior and fields named in the NVD description.

Sigma Rule

title: Capgo Unauthorized Role Binding Demotion via PATCH (CVE-2026-100629)
id: 8d2f5a1c-3b6e-4c7a-9f01-202610062900
status: experimental
description: Detects PATCH requests to the Capgo role_bindings endpoint that may demote an org_super_admin binding, exploiting missing prior-role rank validation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100629
author: valtersit.com
date: 2026/10/06
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'PATCH'
    cs-uri-stem|contains: '/private/role_bindings/'
  selection_role:
    - cs-uri-query|contains: 'org_member'
    - cs-uri-query|contains: 'role'
  condition: selection_endpoint and selection_role
falsepositives:
  - Legitimate administrative role reassignment by authorized super administrators
level: medium
tags:
  - attack.impact
  - attack.t1562.001
  - cve.2026.100629

YARA Rule

rule CVE_2026_100629_Capgo_RoleBinding_Patch
{
    meta:
        description = "Detects Capgo role binding demotion attempts / references to CVE-2026-100629 endpoint patterns in logs or artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100629"
        date = "2026-10-06"
        cve = "CVE-2026-100629"

    strings:
        $ep = "/private/role_bindings/" ascii wide nocase
        $m1 = "PATCH" ascii
        $r1 = "org_super_admin" ascii wide
        $r2 = "org_member" ascii wide
        $r3 = "org_admin" ascii wide
        $tr = "prevent_last_super_admin_binding_delete" ascii

    condition:
        any of ($ep) and (
            ($m1 and ($r1 or $r2)) or
            ($r1 and $r2) or
            $tr
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100629 Capgo Role Binding Demotion via PATCH"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/private/role_bindings/"; http.request_body; content:"org_member"; nocase; reference:cve,2026-100629; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-100629; classtype:attempted-admin; sid:2026100629; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "PATCH" and
      http.request.uri : "/private/role_bindings/*"]
  [http where http.request.method == "PATCH" and
      http.request.uri : "/private/role_bindings/*" and
      http.request.body.content : ("org_member" or "role")]

Splunk SPL Query

index=web OR index=proxy
| where match(http_method, "(?i)PATCH") AND like(uri_path, "%/private/role_bindings/%")
| eval suspicious=if(match(_raw, "(?i)org_member|org_super_admin|role_bindings"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(status) as status_codes by src_ip, user, http_method
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="capgo,web,cve-2026-100629,">
  <rule id="202610629" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">PATCH</field>
    <url>/private/role_bindings/</url>
    <description>CVE-2026-100629: PATCH to Capgo role_bindings endpoint - possible super admin demotion attempt</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict the org_admin role's ability to perform updates against role_bindings where the currently bound role outranks the caller. This can be enforced by intercepting or denying such requests at a reverse proxy / API gateway until code is fixed.
   • Temporarily restrict PATCH /private/role_bindings/:binding_id to org_super_admin callers only, as an interim compensating control.
   • Audit the current role binding state for any organization that may have been left without an org_super_admin, and restore super-admin bindings through a controlled out-of-band process.
   • Add monitoring/alerting on role binding modifications originating from org_admin accounts (see Detection Guidance).

2. Patch / upgrade steps.

   • The NVD description states the issue is fixed in 12.127.5; upgrade Capgo backend to 12.127.5 or later. Because no vendor advisory or commit is tracked (patch confidence 0/4), verify the fix directly with the vendor and confirm the fixed behavior in a staging environment: (a) the PATCH handler enforces the rank check on the currently bound role, and (b) an UPDATE path cannot remove the last super administrator.
   • Confirm any database trigger behavior around last-super-admin protection covers UPDATE, not only DELETE.

3. Long-term hardening.

   • Apply consistent authorization semantics across all sibling handlers (DELETE, PATCH, PUT) for the same resource; review the codebase for other handlers with asymmetric validation.
   • Enforce last-super-admin invariants at the database or domain layer for all mutating operations (INSERT, UPDATE, DELETE), not only DELETE.
   • Adopt a testing policy that explicitly covers "existing object state" authorization checks (modify-not-create versus modify-existing), including negative tests for privilege ranking across every handler.
   • Implement least-privilege role design so that no single role other than the intended one can alter higher-ranked bindings.

References

1. NVD — CVE-2026-100629: https://nvd.nist.gov/vuln/detail/CVE-2026-100629
2. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
3. MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools — https://attack.mitre.org/techniques/T1562/001/
4. FIRST EPSS — CVE-2026-100629 (not yet scored at time of writing)
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-100629 not listed (as of report date)

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-100629 at this time. No public PoC, Nuclei template, or exploit code was identified.