CVE-2026-56247: Capgo Privilege Escalation Vulnerability

CVE-2026-56247 Overview

CVE-2026-56247 is a privilege escalation vulnerability in Capgo versions prior to 12.128.2. The flaw allows organization administrators to assign organization-scoped Role-Based Access Control (RBAC) roles at app scope without validating role scope compatibility. Attackers can pre-seed malformed high-privilege bindings on pending invitations that persist after invite acceptance. Once accepted, a low-privilege user gains unauthorized privileged app actions. The vulnerability is categorized under [CWE-266: Incorrect Privilege Assignment] and is exploitable over the network with low privileges.

Critical Impact
Low-privilege users can execute privileged app-scope operations after accepting pre-seeded malformed RBAC bindings, breaking Capgo's authorization boundary.

Affected Products

Capgo versions before 12.128.2
Capgo self-hosted deployments using the built-in RBAC subsystem
Capgo multi-tenant organizations with app-scoped role bindings

Discovery Timeline

2026-06-30 - CVE-2026-56247 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56247

Vulnerability Analysis

Capgo implements RBAC with distinct scopes for organizations and applications. The role assignment endpoint accepts a target scope (app) and a role identifier, but the server does not verify that the role definition is compatible with the requested scope. An organization administrator can therefore bind an organization-scoped role, such as an org admin equivalent, at the app scope. The binding is stored intact and evaluated by downstream authorization checks as a valid high-privilege grant.

The issue extends to invitation flows. Bindings created for pending invitees are not re-validated when the invitee accepts. A malformed binding placed on a pending invite survives acceptance, promoting the accepted account beyond its intended app-level role. The attack requires only existing org-admin privileges and produces a persistent privilege escalation vector against any app in the organization.

Root Cause

The root cause is missing scope compatibility validation during role assignment. Capgo's authorization layer trusts the caller-supplied scope value and does not cross-check it against the role's declared scope in the role catalog. This is a classic incorrect privilege assignment defect [CWE-266], compounded by the absence of revalidation at the invite-acceptance boundary.

Attack Vector

An attacker with organization administrator access invites a target user or targets an existing pending invitation. The attacker calls the role-assignment API with an org-scoped role identifier and an app scope target. The server persists the binding without error. When the invitee accepts, the malformed binding becomes active, granting the low-privilege user privileged app operations such as release publishing, channel manipulation, or configuration changes. No user interaction is required from the victim beyond normal invite acceptance.

Refer to the GitHub Security Advisory GHSA-55q2-p3m2-x66x and the VulnCheck Privilege Escalation Advisory for additional technical context.

Detection Methods for CVE-2026-56247

Indicators of Compromise

Role bindings where the assigned role's declared scope is organization but the binding target scope is app.
Audit log entries showing app-scope role assignments referencing role identifiers reserved for org-level administration.
Accepted invitations where the resulting user immediately performs privileged app actions such as release publishing or channel updates.
API calls to role-assignment endpoints with mismatched scope and role_id parameters.

Detection Strategies

Query the Capgo database or admin API for existing role bindings and flag rows where role.scope does not equal binding.scope.
Correlate invitation acceptance events with subsequent privileged operations performed within a short time window by the new user.
Alert on org-admin accounts creating or modifying invitations that carry non-standard role bindings.

Monitoring Recommendations

Enable and centralize Capgo application audit logs for role assignment, invitation, and privileged app operations.
Baseline the expected role catalog per organization and alert when app-scope bindings reference roles outside that baseline.
Review org-admin activity regularly, focusing on invite creation followed by immediate role changes.

How to Mitigate CVE-2026-56247

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted deployments.
Enumerate existing role bindings and revoke any where role scope and binding scope do not match.
Audit pending invitations and remove or reissue any invitation that carries a suspicious role binding.
Rotate credentials and session tokens for accounts that received malformed bindings.

Patch Information

The vulnerability is fixed in Capgo 12.128.2. The patch enforces scope compatibility between the role definition and the assignment target, and revalidates bindings during invite acceptance. See the GitHub Security Advisory GHSA-55q2-p3m2-x66x for the fix commit and upgrade instructions.

Workarounds

Restrict organization administrator membership to a minimum trusted set until the patch is applied.
Manually review every app-scope role binding and delete any binding that references an org-scoped role.
Freeze invitation acceptance for pending invites created during the exposure window and reissue them after upgrading.

bash

# Example: identify mismatched bindings and upgrade Capgo
# 1. Inspect current version
capgo --version

# 2. Upgrade to the fixed release
npm install -g @capgo/cli@^12.128.2

# 3. Review app-scope bindings and revoke any org-scoped role assigned at app scope
capgo org role list --scope app --show-role-scope
capgo org role revoke --binding-id <BINDING_ID>