CVE-2026-88863 capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...

CVE-2026-88863

capgo.app npm package "capgo" through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...

CVE-2026-88863: Improper Privilege Management

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...