CVE-2026-88863

Executive Summary

CVE-2026-88863 is a broken access control vulnerability in the Capgo npm package (capgo) through version 12.207.1, specifically within the validateInvite() function of the Supabase edge function invite_new_user_to_org.ts. An authenticated user with only the org.invite_user permission (such as an org_member) can invite an external user as org_admin or org_billing_admin. When the invitation is accepted, the system creates the role binding using the Supabase service-role key, which bypasses critical database triggers designed to prevent privilege escalation. Successful exploitation grants the attacker full administrative control over the organization's apps, channels, members, and billing. The vulnerability has a CVSS score of 8.1, reflecting a high impact on confidentiality and integrity, with no patch currently available from tracked sources.

Technical Analysis

The vulnerability resides in the Capgo backend, an npm package that provides update and deployment services for Capacitor applications, leveraging Supabase for authentication and authorization. The specific flaw is in the validateInvite() function located at supabase/functions/_backend/private/invite_new_user_to_org.ts. This function is responsible for validating whether a user has the necessary permissions to invite new users to an organization.

The core issue is a missing authorization check: the function does not compare the caller's role rank against the requested role for the invitation. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission when the invitation is for an org_super_admin. For other elevated roles such as org_admin or org_billing_admin, the endpoint merely checks for the org.invite_user permission. This means any authenticated user with the org.invite_user permission—typically an org_member or lower-privileged user—can invite an external party with administrative roles.

When the invited user accepts the invitation via POST /private/accept_invitation, the ensureOrgMembership function creates the role binding using the Supabase service-role key. This service-role key has elevated privileges that bypass database-level security measures, specifically the prevent_role_binding_priority_escalation and check_org_user_privileges triggers. These triggers are designed to prevent unauthorized privilege escalation by enforcing role hierarchy and permission checks at the database level. By using the service-role key, the application effectively circumvents these protections, allowing the role binding to be created without any further validation.

The attack surface is the Capgo API, exposed via Supabase edge functions. The vulnerability requires network access to the API and a valid authenticated session with the org.invite_user permission. The attack is low-complexity and does not require user interaction beyond the initial invitation acceptance by the attacker-controlled external account.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-88863. The attack chain is inferred from the vulnerability class (CWE-269: Improper Privilege Management) and the NVD description.

1. Reconnaissance and Target Identification: The attacker identifies a target organization using Capgo. This could be any organization that uses the Capgo service for app updates. The attacker needs to have a valid account within that organization with at least the org.invite_user permission. This could be obtained through legitimate means (e.g., being a low-privileged member) or through prior compromise of a low-privileged account. The attacker confirms the Capgo version is <= 12.207.1.

2. Triggering the Flaw: The attacker sends a crafted request to the POST /private/invite_new_user_to_org endpoint. The request includes parameters specifying the email address of an external user (controlled by the attacker) and the desired role, such as org_admin or org_billing_admin. Because the endpoint only checks for the org.invite_user permission and does not validate whether the inviter's role rank is sufficient to grant such elevated roles, the invitation is created successfully.

3. Payload/Execution Method: The payload is a standard HTTP POST request to the vulnerable endpoint. The attacker must be authenticated and include a valid session token. The request body likely contains fields such as the invitee's email and the target role. No specific parameter names are available from the NVD description; the attack exploits the missing authorization logic rather than a code injection or memory corruption.

4. Post-Exploitation Impact: The attacker-controlled external user receives the invitation and accepts it via POST /private/accept_invitation. During acceptance, the ensureOrgMembership function uses the Supabase service-role key to create the role binding. This bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. As a result, the attacker-controlled account is now an org_admin or org_billing_admin, granting full administrative control over the organization's apps, channels, members, and billing. The attacker can then modify application configurations, access sensitive data, disrupt services, or commit financial fraud through billing manipulation.

Impact Assessment

The CVSS score is 8.1 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This indicates:

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): Low complexity; no special conditions required.
• Privileges Required (PR:L): Requires low privileges (authenticated user with org.invite_user permission).
• User Interaction (UI:N): No user interaction required beyond the attacker accepting their own invitation.
• Scope (S:U): Impact confined to the vulnerable component.
• Confidentiality (C:H): High impact; attacker gains access to sensitive organizational data.
• Integrity (I:H): High impact; attacker can modify applications, channels, and billing.
• Availability (A:N): No direct availability impact.

The business impact is severe. An attacker with administrative control over an organization's Capgo environment can push malicious updates to applications, exfiltrate sensitive data, manipulate billing information, and disrupt services. The blast radius includes all apps, channels, and members within the compromised organization. Since Capgo is used for over-the-air updates in mobile applications, a compromised account could lead to supply chain attacks affecting end-users of those apps. The vulnerability is particularly dangerous because it requires only low privileges and is trivial to exploit once an attacker has any foothold in the organization.

Detection Guidance

Sigma Rule

title: Capgo Privilege Escalation via Invite New User to Org
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-88863 by inviting a user with elevated roles without proper authorization.
author: Valters IT
date: 2026-05-15
logsource:
    product: capgo
    service: api
detection:
    selection_endpoint:
        http.method: 'POST'
        http.url|endswith: '/private/invite_new_user_to_org'
    selection_roles:
        http.request.body|contains:
            - 'org_admin'
            - 'org_billing_admin'
    condition: selection_endpoint and selection_roles
falsepositives:
    - Legitimate administrators inviting users with these roles.
level: high
tags:
    - attack.privilege_escalation
    - cve.2026.88863

YARA Rule

rule CVE_2026_88863_Capgo_Privilege_Escalation
{
    meta:
        description = "Detects Capgo invite_new_user_to_org exploitation attempts"
        author = "Valters IT"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88863"
        cve = "CVE-2026-88863"
    strings:
        $endpoint = "/private/invite_new_user_to_org"
        $role1 = "org_admin"
        $role2 = "org_billing_admin"
        $func = "validateInvite"
    condition:
        any of ($endpoint, $func) and any of ($role1, $role2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88863 Capgo Privilege Escalation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/private/invite_new_user_to_org"; http_uri; content:"org_admin"; http_client_body; nocase; reference:cve,2026-88863; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic Detection

sequence by user.id
  [http where http.request.method == "POST" and http.request.uri == "/private/invite_new_user_to_org" and http.request.body contains "org_admin"]
  [http where http.request.method == "POST" and http.request.uri == "/private/accept_invitation"]

Splunk SPL Query

index=web sourcetype=capgo:api
| search http_method=POST uri="/private/invite_new_user_to_org"
| rex field=request_body "role\":\"(?<role>[^\"]+)"
| where role="org_admin" OR role="org_billing_admin"
| stats count by src_ip, user, role
| where count > 0

Wazuh OSSEC Rule

<group name="capgo,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="http.url">/private/invite_new_user_to_org</field>
    <field name="http.request.body">org_admin</field>
    <description>CVE-2026-88863: Capgo privilege escalation attempt detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vulnerability is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations. However, no official patch release or version number has been confirmed by tracked sources.

1. Immediate Mitigations:

   • Restrict the org.invite_user permission to only trusted users. Audit all users with this permission and remove it from those who do not require it.
   • Implement a Web Application Firewall (WAF) rule to block or alert on requests to /private/invite_new_user_to_org that attempt to assign org_admin or org_billing_admin roles.
   • Monitor API logs for anomalous invitation patterns, especially invitations sent by low-privileged users for elevated roles.
   • Disable the invitation feature entirely if not essential, or enforce manual approval for all invitations.

2. Patch/Upgrade Steps:

   • Monitor the Capgo GitHub repository for the release containing pull request #3096 and upgrade to the patched version once available.
   • As an interim measure, apply the code change from PR #3096 manually if self-hosting the Supabase functions.
   • Verify the version of the capgo npm package and Supabase functions in use. If version 12.207.1 or earlier, plan for an upgrade.

3. Long-Term Hardening:

   • Implement role hierarchy checks at the application layer for all privileged operations, not just at the database level.
   • Enforce the principle of least privilege: ensure that service-role keys are not used for operations that should be subject to row-level security and triggers.
   • Regularly audit role bindings and permissions within Supabase to detect unauthorized escalations.
   • Adopt a defense-in-depth approach: combine application-layer validation, database triggers, and monitoring to prevent and detect privilege escalation attempts.
   • Conduct security reviews of all edge functions to ensure proper authorization checks are in place.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88863
• Capgo GitHub Pull Request #3096: https://github.com/Cap-go/capgo/pull/3096
• CWE-269: Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• Capgo Documentation: https://capgo.app/docs/
• No known threat actor campaigns or exploit-in-the-wild evidence at this time. CISA KEV: NO. EPSS score not yet available from FIRST.org.