CVE-2026-56215: Capgo Account Takeover via Email Modification and SSO Merge

Technical summary

The vulnerability exists in Capgo's SSO provisioning endpoint, which uses the public.users.email column as a trust anchor for account merging operations. The system allows authenticated users to modify this email field to arbitrary values without sufficient validation. When the provision-user endpoint processes SSO authentication requests, it uses the email address as an account-merge key without verifying that the email modification was authorized or legitimate. An attacker can pre-position their account with a victim's corporate SSO email address, and when the victim authenticates via SSO, the provisioning logic will merge their SSO identity into the attacker-controlled account, granting the attacker full access to the victim's session and data.

Business impact

This vulnerability enables account hijacking at scale for any organization using Capgo with SSO authentication. An attacker with a single valid account can compromise any other user account in the system by claiming their email address. This breaks fundamental authentication trust and could allow attackers to access sensitive data, modify organizational settings, steal credentials, or pivot to connected systems. Organizations relying on Capgo for identity management face direct risk to user privacy, data confidentiality, and regulatory compliance (GDPR, HIPAA, SOC 2, etc.).

Affected systems

Capgo versions before 12.128.12 are affected. The vulnerability requires an authenticated user account on the target Capgo instance, and impacts any organization where users authenticate via SSO (SAML, OpenID Connect, or similar). Installations without SSO integration are at lower risk for this specific attack path, though the underlying email manipulation issue persists.

Exploitability

Exploitation requires valid authentication credentials to the Capgo platform, so it is not remotely exploitable by unauthenticated attackers. However, the bar for attack is low: an attacker can register a free or low-privilege account, then immediately begin modifying their email to target other users. No special network conditions or timing windows are required. The attack is deterministic and reliable. Given that SSO is commonly deployed in enterprise environments, the practical reach is significant.

Remediation

Upgrade Capgo to version 12.128.12 or later. This update addresses the root cause by implementing proper authorization checks on email modifications and by ensuring the SSO provisioning endpoint validates that email changes are legitimate before using them as account-merge keys. Organizations should also audit their Capgo instance for evidence of suspicious email modifications or account merge events that may indicate prior exploitation.

Patch guidance

Apply the update to Capgo 12.128.12 or newer as soon as operationally feasible, prioritizing this over other patches due to the HIGH severity score and the ease of exploitation. Verify the patch version in your Capgo deployment via the admin dashboard or API endpoint (typically /api/version or similar; consult your Capgo documentation). If you are running a version between the current release and 12.128.12, do not delay the upgrade. Test the patch in a staging environment first to confirm SSO functionality remains intact, then roll out to production. Monitor for any anomalous provisioning events during and after the upgrade.

Detection guidance

In your Capgo logs and audit trails, look for: (1) Authenticated users modifying their email address to domains they do not own or control; (2) Multiple email modifications from the same user account in short time windows; (3) Email changes immediately preceding or coinciding with SSO provision-user endpoint calls; (4) Account merge events that do not align with legitimate user actions. Enable detailed audit logging on the users table and the provision endpoint if available. Correlate email modification logs with SSO authentication logs to identify mismatches. Consider alerting on any email change to a corporate domain that is not originating from that domain's IP range or known corporate network.

Why prioritize this

This vulnerability scores 8.3 (HIGH) and merits immediate attention because it enables account takeover with minimal attacker effort. The attack requires only basic user access, has no complex preconditions, and directly undermines the security properties of SSO authentication—a control that organizations typically rely on for trust and compliance. The fact that it is not yet in the KEV catalog does not diminish urgency; active monitoring suggests exploitation is plausible.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects: Network-accessible attack vector (AV:N); Low attack complexity (AC:L); Low privilege requirement (PR:L) — any authenticated user suffices; No user interaction required (UI:N); Confidentiality impact (C:H) — attacker gains access to victim's data; Integrity impact (I:H) — attacker can modify victim's account and data; and Availability impact (A:L) — resource consumption or denial of service to the victim. The HIGH severity is appropriate given the ease of exploitation and the scope of potential damage.

Frequently asked questions