The vulnerability in Capgo prior to version 12.128.2 involves a failure to clear the org_users.user_right column during role binding deletion. As a result, users who have been demoted from the super_admin role still retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs. This stale privilege allows attackers to maintain previously granted super_admin capabilities, enabling them to enumerate and bulk delete non-compliant bundles organization-wide indefinitely. The issue is categorized under CWE-285 (Improper Authorization).

Attackers who exploit this vulnerability can escalate privileges by retaining super_admin access after demotion, allowing them to enumerate and delete non-compliant bundles across the entire organization. This could lead to unauthorized data deletion and disruption of organizational operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor vendor communications for updates and consider restricting role changes or auditing RPC access until a fix is available.