An improper authorization vulnerability in Capgo allows stale organization users to retain unauthorized privileges, posing a risk of privilege escalation within the platform.

The vulnerability is an Improper Authorization issue (CWE-285). It occurs when a user is demoted or removed from an organization, but their previous access rights are not correctly revoked, allowing for potential privilege retention.

With a CVSS score of 8.3, this vulnerability threatens the confidentiality and integrity of organizational data. An attacker could exploit stale sessions or remaining permissions to access sensitive project data or perform administrative actions they are no longer authorized to execute, potentially leading to unauthorized data modification.

Immediate Action: Update the Capgo platform to version 12.128.2 or later to ensure proper authorization checks are enforced.

Proactive Monitoring: Review user permissions and organization membership logs to identify accounts that may have retained access beyond their intended lifecycle.

Compensating Controls: Enforce mandatory periodic re-authentication and session invalidation for users changing roles or organizations to mitigate the impact of stale authorizations.

Public Exploit Available: Unknown

Organizations utilizing Capgo should treat this update as high priority to prevent unauthorized access by former or demoted users. Perform a comprehensive audit of current user access rights after applying the security update.