CVE-2026-56223: Capgo Cross-Domain Account Takeover via SAML Assertion Forgery

Technical summary

CVE-2026-56223 is an improper authentication vulnerability (CWE-287) in Capgo's provision-user endpoint that fails to validate SSO provider domain authorization. The vulnerability allows attackers with enterprise organization admin credentials to exploit SAML assertion forgery. By sending crafted SAML assertions containing victim email addresses to the provision-user endpoint, an attacker can trigger cross-domain account merges without proper domain ownership validation. The absence of authorization checks on which domains an IdP is permitted to provision users for enables account consolidation attacks that grant the attacker full account access, organization membership, and data visibility for victim accounts.

Business impact

Successful exploitation enables complete account takeover of individual users and organizations within Capgo. Attackers can access sensitive organizational data, modify configurations, and perform actions on behalf of compromised accounts. For enterprises using Capgo for critical application management or deployment orchestration, this represents loss of confidentiality and integrity of their entire operational environment. The attack requires admin-level access to a federated organization, making it a particularly severe insider threat vector and a risk for multi-tenant SaaS environments where one compromised admin can attack users across multiple customer organizations.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability exists in the provision-user endpoint and impacts any Capgo deployment using SAML-based single sign-on with federated enterprise organizations. Organizations relying on Capgo for app deployment, release management, or CI/CD integration should prioritize verification of their installed version.

Exploitability

Exploitation requires high privilege level (enterprise organization admin access) and a malicious or compromised identity provider under attacker control. The attack is network-accessible with no user interaction required from victims. While the privilege requirement is high, the barrier to exploitation is relatively low once an attacker has obtained or controls an IdP—SAML assertion forgery is straightforward, and the vulnerable endpoint accepts the malicious requests without validation. Organizations with federated SSO and multiple admin accounts face meaningful risk.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch addresses the domain authorization validation gap in the provision-user endpoint, ensuring that identity providers can only provision users for domains they are explicitly authorized to manage. Verify the upgrade was successful by confirming the installed version and, where applicable, monitoring for any unexpected account merges or permission changes in audit logs.

Patch guidance

Apply Capgo update 12.128.2 or later to all affected deployments. Verify against the official Capgo release notes and vendor advisory for any prerequisites or post-patch validation steps. Organizations should test the patch in a staging environment to confirm compatibility with existing SAML configurations before production deployment. After patching, conduct a retrospective audit of user accounts and organization memberships to detect any unauthorized account merges that may have occurred.

Detection guidance

Monitor Capgo's provision-user endpoint access logs and SAML assertion handling for anomalies, including provision requests from IdPs attempting to merge accounts across different email domains. Alert on admin API calls to the provision-user endpoint combined with unusual account merge activity. Review federation trust relationships and confirm that only expected IdPs are configured for account provisioning. Cross-reference user merge events with known legitimate provisioning flows and organizational changes. Check for any accounts that were merged without corresponding legitimate SSO domain changes.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.7), direct path to account takeover, and broad organizational blast radius. The ability to merge accounts across domain boundaries means a single compromised admin plus a malicious IdP can compromise multiple user accounts and entire organizations. The absence of KEV status does not diminish urgency—the technical severity and ease of exploitation once prerequisites are met demand swift patching. Organizations should treat this as a critical security incident risk and prioritize Capgo updates accordingly.

Risk score, explained

CVSS 8.7 (HIGH) reflects a network-accessible attack with high privilege requirements but no user interaction needed, affecting multiple attack vectors (confidentiality, integrity, and scope). The score captures the severe impact—complete account takeover—balanced against the prerequisite of admin-level access and a malicious IdP. For organizations with robust IdP security controls and limited admin accounts, risk may trend lower; for those with federated multi-admin setups, risk is substantially higher.

Frequently asked questions