Capgo version 12.128.12 or earlier permits authenticated users to change their mutable public.users.email field to any address. The SSO provisioning endpoint treats this email as a key for merging accounts. An attacker can pre‑set their own account with a victim’s corporate SSO email and then trigger the provision‑user flow, causing the victim’s SSO identity to be merged into the attacker-controlled account. This results in unauthorized access to the victim’s resources and possible privilege escalation. The weakness is identified as CWE‑639, the misuse of user supplied input for authorization decisions.

All installations of Capgo with a release prior to 12.128.12 are affected. The vulnerability applies to any deployment that uses the public.users table and the SSO provisioning endpoint. No specific host or environment is required beyond the use of Capgo’s default authentication and SSO features.

The CVSS score is 8.7, indicating a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only an authenticated session and access to the API that updates public.users.email; no elevated privileges or network access beyond the CAPGO service are necessary. Attackers can pre‑position a poisoned email address and then invoke the SSO provisioning flow, which the system trusts without additional validation. The potential for data compromise and breach of corporate SSO identities makes this a serious risk for affected organizations.