CVE-2026-56251: Capgo Privilege Escalation Vulnerability

CVE-2026-56251 Overview

CVE-2026-56251 is a privilege escalation vulnerability in Capgo, an open-source live-update server for Capacitor mobile applications. Versions prior to 12.128.2 contain a broken row level security (RLS) policy on the org_users table. The flawed policy permits authenticated users with admin role to modify their own role assignment and escalate to super_admin. The weakness is classified under [CWE-266: Incorrect Privilege Assignment].

Successful exploitation grants attackers full administrative control over the Capgo instance, including organization data and tenant resources.

Critical Impact
An authenticated admin user can elevate to super_admin and gain unrestricted control over organization resources, application updates, and tenant data.

Affected Products

Capgo server versions prior to 12.128.2
Self-hosted Capgo deployments using the affected org_users RLS policy
Capgo Capacitor live-update infrastructure relying on Supabase-style row level security

Discovery Timeline

2026-06-21 - CVE-2026-56251 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56251

Vulnerability Analysis

Capgo enforces tenant and role separation through PostgreSQL row level security policies on the org_users table, which maps users to organizations and roles. The RLS policy governing updates does not adequately restrict which columns an authenticated user can modify. An attacker authenticated as an organization admin can issue an update against their own org_users row and change the role column to super_admin.

Once elevated, the attacker inherits permissions across the entire deployment rather than being scoped to a single organization. This breaks the multi-tenant trust boundary that Capgo relies on for isolation.

The issue requires valid authenticated credentials with admin role, which limits opportunistic exploitation but creates significant risk from insider threats and account compromise scenarios.

Root Cause

The root cause is an overly permissive RLS UPDATE policy on org_users that fails to constrain mutations to non-privileged columns. The policy validates the row owner but does not prevent the owner from altering the role field itself, violating the principle of least privilege.

Attack Vector

The attack is performed over the network against the Capgo API or backing PostgreSQL/PostgREST endpoint. An authenticated admin sends an authenticated update request targeting their own org_users record and sets role = 'super_admin'. No user interaction is required and no additional exploitation chain is needed beyond a valid admin session.

The vulnerability is described in detail in the GitHub Security Advisory GHSA-9xqh-f26v-9c9h and the Vulncheck Privilege Escalation Advisory. Refer to those sources for the specific policy definitions and request patterns.

Detection Methods for CVE-2026-56251

Indicators of Compromise

Unexpected changes to the role column in the org_users table, particularly transitions from admin to super_admin.
API requests issuing PATCH or UPDATE operations against org_users records where the requesting principal matches the target row.
Sudden appearance of additional super_admin accounts not provisioned by trusted administrators.

Detection Strategies

Enable PostgreSQL audit logging on the org_users table and alert on any UPDATE statement that modifies the role column.
Compare current super_admin membership against a known-good baseline and trigger alerts on drift.
Review application access logs for admin accounts performing self-targeted role updates immediately followed by privileged actions.

Monitoring Recommendations

Forward Capgo application and database logs to a centralized SIEM with retention sufficient for retrospective hunting.
Build correlation rules that link role changes in org_users with subsequent administrative API calls such as token issuance or organization configuration changes.
Monitor authentication telemetry for admin accounts exhibiting unusual session sources or activity patterns.

How to Mitigate CVE-2026-56251

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which corrects the org_users RLS policy.
Audit the org_users table for unauthorized super_admin entries and revert illegitimate role assignments.
Rotate API tokens and session credentials associated with any account whose role was modified.
Review administrative actions performed by super_admin accounts since deployment of the vulnerable version.

Patch Information

The fix is included in Capgo 12.128.2. The patched release tightens the row level security policy on org_users so authenticated users cannot modify the role column of their own row. See the GitHub Security Advisory GHSA-9xqh-f26v-9c9h for upgrade instructions and policy details.

Workarounds

If immediate upgrade is not feasible, replace the vulnerable RLS policy with one that explicitly forbids updates to the role column by non-super_admin users.
Restrict direct database or PostgREST access so that role changes can only be performed through a server-side function executed with elevated privileges and explicit authorization checks.
Temporarily reduce the number of accounts holding the admin role to limit the population capable of exploiting the flaw.

bash

# Example RLS hardening for the org_users table (apply only after review)
ALTER TABLE org_users ENABLE ROW LEVEL SECURITY;

DROP POLICY IF EXISTS org_users_update ON org_users;

CREATE POLICY org_users_update ON org_users
  FOR UPDATE
  USING (auth.uid() = user_id)
  WITH CHECK (
    auth.uid() = user_id
    AND role = (SELECT role FROM org_users WHERE user_id = auth.uid())
  );