Threats tagged 'ghsa-56rm-j3fv-2h9m'

Capgo.app versions prior to 12.127.5 contain an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. This flaw allows an authenticated user with the org_admin role (rank 90) to demote an org_super_admin (rank 95) to a lower-privileged role, potentially removing all super administrators from an organization. The issue arises because the endpoint does not verify the current role's rank before allowing the change, and a database trigger that prevents deleting the last super admin does not apply to updates. The vulnerability is fixed in version 12.127.5.