capgo.app's row-level security UPDATE policy on the public.orgs table permits organization admins holding the org.update_settings permission to update all fields of the organization's row, including the internal billing pointer customer_id. Although the official organization update endpoint restricts editable fields and excludes customer_id, and billing updates require the org.update_billing permission, an authenticated org admin can bypass these restrictions by sending direct updates to Supabase PostgREST. This can corrupt or nullify the Stripe customer_id, causing billing and plan verification failures and effectively downgrading the organization to an unpaid or no-plan status. No patch or fix is currently available.

An authenticated organization admin without billing update permissions can corrupt or nullify the Stripe customer_id pointer by directly updating the public.orgs table. This causes plan and billing checks that rely on this pointer to fail, resulting in the organization losing its valid paid plan status and being treated as unpaid or without a plan. This impacts billing integrity and service entitlement but does not disclose sensitive data or allow privilege escalation beyond the org admin role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict direct access to Supabase PostgREST endpoints that allow updates to the public.orgs table or monitor and audit such requests to detect unauthorized modifications to the customer_id field. Consider limiting org.update_settings permissions to trusted users only.