CVE-2026-56241: Capgo Privilege Escalation Vulnerability

CVE-2026-56241 Overview

CVE-2026-56241 is a privilege escalation vulnerability in Capgo before version 12.128.2. The flaw allows demoted super_admin users to retain access to sensitive Remote Procedure Calls (RPCs) after their role binding is removed. The root cause is a stale org_users.user_right column that is not cleared during role binding deletion. Attackers who previously held the super_admin role can continue to invoke delete_non_compliant_bundles and count_non_compliant_bundles RPCs indefinitely. This enables enumeration and bulk deletion of non-compliant bundles across the entire organization. The vulnerability is classified under CWE-285: Improper Authorization.

Critical Impact
Demoted administrators retain destructive RPC access, enabling organization-wide bundle deletion after role revocation.

Affected Products

Capgo versions prior to 12.128.2
Capgo self-hosted deployments using the affected role-based access control (RBAC) schema
Organizations relying on super_admin demotion for offboarding privileged users

Discovery Timeline

2026-07-12 - CVE-2026-56241 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-56241

Vulnerability Analysis

Capgo implements RBAC through two related structures: role bindings and the org_users.user_right column. When an administrator revokes the super_admin role from a user, the role binding is deleted, but the user_right column retains its prior value. Authorization checks for delete_non_compliant_bundles and count_non_compliant_bundles consult the stale column rather than the authoritative role binding table. This inconsistency creates a persistent grant that survives revocation.

The affected RPCs operate on non-compliant application bundles across the entire organization. count_non_compliant_bundles enumerates targets, and delete_non_compliant_bundles removes them in bulk. A former administrator can therefore inventory and destroy production release artifacts organization-wide with a single authenticated request.

Root Cause

The root cause is inconsistent state management between two authorization sources of truth. The user_right column is set when super_admin is granted but never cleared when the binding is deleted. Authorization logic for the vulnerable RPCs reads only the stale column, bypassing the current binding state. This is a classic broken access control pattern where privilege revocation is incomplete.

Attack Vector

An attacker who previously held super_admin and was subsequently demoted authenticates normally to the Capgo API. The attacker invokes the count_non_compliant_bundles RPC to enumerate deletable bundles. The attacker then calls delete_non_compliant_bundles to remove them in bulk. Because the check relies on the stale user_right value, the request succeeds despite the missing role binding. No exploit or Proof of Concept (PoC) is publicly available at the time of publication.

Detection Methods for CVE-2026-56241

Indicators of Compromise

Unexpected invocations of delete_non_compliant_bundles or count_non_compliant_bundles RPCs from user accounts that no longer hold an active super_admin role binding.
Discrepancies between org_users.user_right values and the current role binding table for the same user.
Bulk bundle deletion events in Capgo audit logs following recent administrator demotion actions.

Detection Strategies

Query the Capgo database to identify users where org_users.user_right indicates super_admin but no corresponding active role binding exists.
Correlate RPC invocation logs with role change history to surface calls made by recently demoted accounts.
Alert on any successful delete_non_compliant_bundles call executed by a non-current administrator.

Monitoring Recommendations

Enable comprehensive audit logging for all RPC endpoints that mutate bundle state.
Monitor role change events and generate follow-up integrity checks against the org_users table.
Track deletion volume baselines and alert on statistical anomalies in bundle removal rates.

How to Mitigate CVE-2026-56241

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which corrects the stale user_right handling during role binding deletion.
Audit the org_users table and manually reset user_right for any user whose current role bindings do not match the stored value.
Review recent invocations of delete_non_compliant_bundles and restore affected bundles from backup where necessary.

Patch Information

The fix is included in Capgo 12.128.2. Refer to the GitHub Security Advisory GHSA-rvvc-rvxv-qcrh and the VulnCheck Security Advisory for advisory details and remediation guidance.

Workarounds

Manually clear the org_users.user_right column immediately after any super_admin role revocation until the patch is applied.
Restrict network access to the affected RPC endpoints via reverse proxy or Web Application Firewall (WAF) rules while remediation is in progress.
Rotate authentication tokens for all previously privileged users following demotion to force re-authentication under current bindings.

bash

# Example remediation query to identify stale super_admin rights
# Run against the Capgo database after upgrading
SELECT ou.user_id, ou.org_id, ou.user_right
FROM org_users ou
LEFT JOIN role_bindings rb
  ON rb.user_id = ou.user_id
 AND rb.org_id  = ou.org_id
 AND rb.role    = 'super_admin'
WHERE ou.user_right = 'super_admin'
  AND rb.user_id IS NULL;