Threats affecting pkg:npm/Capgo

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the org.invite_user permission (e.g., an org_member) can invite an external user as org_admin or org_billing_admin. When the invited account accepts the invitation via POST /private/accept_invitation, ensureOrgMembership creates the role binding using the Supabase service-role key, which bypasses the prevent_role_binding_priority_escalation and check_org_user_privileges database triggers. This allows privilege escalation resulting in full administrative control over the organization's apps, channels, members, and billing. The issue is addressed by pull request #3096, which compares the inviter's rank before permitting elevated invitations.

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

CVE-2026-56330 is an open redirect vulnerability in Capgo versions before 12.128.2. It affects the stripe_portal and stripe_checkout endpoints, which accept unvalidated URL parameters (callbackUrl, successUrl, cancelUrl). Authenticated attackers can exploit this flaw to redirect users to malicious domains, potentially facilitating phishing and credential theft.

CVE-2026-56282 is an information disclosure vulnerability in Capgo versions before 12.128.2. It affects the unauthenticated /replication endpoint, which exposes internal PostgreSQL replication telemetry data such as slot names and WAL LSN positions. This allows unauthorized actors to gather sensitive infrastructure details useful for reconnaissance.

CVE-2026-56325 is a low-severity vulnerability in Capgo versions before 12.128.2 where improper input validation allows underscore characters in app_id to act as SQL wildcards during app_id lookup. This can cause unintended pattern matches that break preview functionality or cause app-id confusion.

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhook_deliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.