Bug 2541809 (CVE-2026-100629)

Summary: CVE-2026-100629 @capgo/backend: Capgo backend: Unauthorized role modification via improper role binding validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, alizardo, dschmidt, gparvin, ikhan, jbalunas, jchui, jhe, jlanda, kshier, ktsao, nboldt, oaljalju, psrna, rbobbitt, rhaigner, simaishi, stcannon, tsze, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Capgo backend. This vulnerability allows an authenticated administrator to perform unauthorized role modifications and demote higher-privileged accounts. When updating role bindings, the application validates the rank of the newly assigned role against the caller's privileges, but fails to verify the current rank of the targeted account. As a result, an administrator can demote organization super administrators to standard user roles, disrupting organizational control and potentially locking out administrative access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-26 13:31:46 UTC 
Capgo (npm package @capgo/backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bound to the target binding. An authenticated user holding the org_admin role (rank 90) can therefore change an org_super_admin binding (rank 95) to a lower-privileged role such as org_member (rank 75). Because the prevent_last_super_admin_binding_delete database trigger fires only BEFORE DELETE and not on UPDATE, an org_admin can demote every org_super_admin, leaving the organization with no super administrator. The issue is fixed in 12.127.5.