{"schema":"threatline.record/2","record":{"id":"CVE-2026-100623","aliases":["GHSA-w349-9mc3-8c5x"],"summary":"Capgo Authentication Bypass via Direct PostgREST org_users Table Write","details":"Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies \"Allow org admin to insert\" and \"Allow org admin to update\" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...)); they do not require a pending invitation in tmp_users, acceptance of an invite token via /private/accept_invitation, any action by the target user, or the membership/role-consistency and anti-escalation checks enforced by the RBAC role-binding path. As a result, an authenticated user who is an admin of an organization can INSERT or UPDATE org_users rows directly to add any existing public.users account as an active member of that organization with user_right=\"admin\", bypassing the invitation and role-assignment workflow entirely. In testing, an account with no prior access to the organization or its apps could, after such a direct insert, read the organization and app and pass check_min_rights. All versions are affected and no patch was available at the time of publication.","categories":["Unclassified"],"product":"capgo.app","vendor":"Cap-go","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100623","source_modified_at":"2026-09-30T17:20:11.439Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"capgo.app","vendor":"Cap-go","versions":[{"version":"0","status":"affected","versionType":"custom","lessThanOrEqual":"*"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00322,"percentile":0.23987,"score_date":"2026-10-23"},"published_at":"2026-09-26T13:23:01.631Z","modified_at":"2026-09-30T17:20:11.439Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100623","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T17:20:11.439Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100623","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Cap-go/capgo.app/security/advisories/GHSA-w349-9mc3-8c5x","tags":["exploit"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/capgo-authentication-bypass-via-direct-postgrest-org-users-table-write","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-09-28T16:59:45.447735Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T17:20:11.439Z","content_hash":"9e8530317321ef75d9466ef4ad20a5672046340872a8ac82a478855fb352ddb7"}}