Privilege escalation via cross-scope role bindings

Incorrect privilege assignment in Capgo before 12.128.2 allows remote authenticated users to modify app data through malformed RBAC bindings. The role-binding handler verifies that a role exists and is assignable but inserts it without matching the role scope to the requested binding scope; the permission resolver then trusts the mismatched role identifier, and invitation acceptance preserves the binding. Exploitation requires an organization administrator in an RBAC-enabled organization to seed a pending invitee, after which the accepted low-privilege account can modify app data outside its intended rights.