capgo.app versions up to 12.207.1 contain an improper privilege management vulnerability in the validateInvite() function located in supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint requires only org.update_user_roles permission for org_super_admin invitations, but does not verify the inviter's role rank against the requested role. Consequently, an authenticated user with org.invite_user permission can invite external users as org_admin or org_billing_admin. Upon acceptance of the invitation via POST /private/accept_invitation, the ensureOrgMembership function creates the role binding using the Supabase service-role key, bypassing database triggers that prevent role escalation. This allows privilege escalation to full administrative control over the organization's apps, channels, members, and billing. The vulnerability is fixed by pull request #3096, which enforces role rank comparison before allowing elevated invitations.

An attacker with authenticated access and the org.invite_user permission can escalate privileges by inviting external users with higher roles such as org_admin or org_billing_admin. This leads to full administrative control over the organization's applications, communication channels, membership, and billing information. The vulnerability compromises the integrity and confidentiality of organizational resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue is addressed by pull request #3096, which adds role rank comparison before permitting elevated invitations. Until an official fix is released, restrict permissions to trusted users and monitor invitation activities closely.