Description
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_mapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from org_admin to org owner/super_admin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds org_admin in that organization. No patched version is available.
Published: 2026-09-26
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Account Takeover
Action: Assess Impact
AI Analysis

Impact

Capgo application versions up to 12.261.0 contain an incomplete access‑control fix for the public.sso_providers table. A database trigger installed by the migration allows updates to the provider_id column while other columns are protected by a before‑update guard. Because the table grants full rights to both anonymous and authenticated roles and row‑level security policies only restrict which rows may be updated, an org_admin (who has org.update_settings permission) can PATCH provider_id through PostgREST. This turns the trusted IdP binding into one chosen by the attacker, enabling them to authenticate as the organization owner, null the owner’s password, delete other identities and sessions, and permanently lock out the legitimate account. The vulnerability is a classic example of improper authorization (CWE‑639).

Affected Systems

Cap‑go:capgo.app users of any installation version up to 12.261.0 are at risk. The flaw resides in the public.sso_providers table of the Capgo database and affects all organizations configured with an SSO provider.

Risk and Exploitability

The CVSS score of 8.6 indicates a high‑severity condition. EPSS data is not available, and the vulnerability is not listed in the CISA known‑exploited catalog, but the attack requires an org_admin role and an active SSO provider – realistic prerequisites in many deployments. The exploit path is straightforward: obtain org_admin rights, issue a PATCH to provider_id, and hijack the owner account. This results in vertical privilege escalation and account takeover.

Generated by OpenCVE AI on September 26, 2026 at 14:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Revoke or restrict the org.update_settings permission from org_admin users to eliminate their ability to PATCH provider_id via PostgREST.
  • Implement a database trigger or column‑level privilege rule that blocks updates to provider_id, metadata_url, and attribute_mapping for all roles except super‑administrators.
  • Monitor the public.sso_providers table for unexpected writes and audit SSO configuration changes on a regular basis.
  • Apply an official patch or upgrade to a later Capgo version (no patch is currently available) as soon as it is released.

Generated by OpenCVE AI on September 26, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_mapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from org_admin to org owner/super_admin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds org_admin in that organization. No patched version is available.
Title Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-26T13:22:53.997Z

Reserved: 2026-09-26T02:30:34.353Z

Link: CVE-2026-100612

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-26T14:16:41.753

Modified: 2026-09-26T14:16:41.753

Link: CVE-2026-100612

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T15:00:14Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key