Cap-go's capgo.app exposes the legacy membership table public.org_users through Supabase PostgREST. The row-level security policies permit organization admins to insert or update rows if they have admin rights, but these policies do not require the target user to have a pending invitation, accept an invite token, or pass role-binding consistency and anti-escalation checks. Consequently, an authenticated admin can directly add any existing public.users account as an active admin member of the organization, bypassing invitation and role-assignment workflows. Testing showed that accounts with no prior access could gain admin rights and read organization and app data after such direct inserts. All versions are affected, and no patch was available at the time of disclosure.

An authenticated organization admin can escalate privileges by directly adding any existing user as an admin member of the organization without the target user's consent or invitation acceptance. This bypasses intended security workflows, potentially allowing unauthorized access to organization and application data. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating significant impact on confidentiality, integrity, and availability.

No patch was available at the time of publication. Organizations should monitor for unauthorized membership changes and restrict admin privileges carefully. Check the vendor advisory for any updates or official fixes. Since this is not a cloud service, remediation depends on vendor patching or configuration changes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.