Capgo does not enforce write restrictions on the public.sso_providers table exposed via Supabase PostgREST. An attacker with a regular Capgo full API key can insert a record marked "active" and "enforce_sso", bypassing all backend SSO provisioning controls, including plan checks, Supabase function calls, DNS TXT verification, status transitions, and the issuance of a trusted provider ID. The forged entry is then trusted by the SSO discovery logic, and unauthenticated checks report the domain as having active SSO even though it was never verified. This permits the attacker to enforce SSO for arbitrary domains, disrupting login flows and allowing unauthorized access.

All versions of Capgo (capgo.app) are affected. The flaw lies in the public PostgREST endpoint that exposes the sso_providers table. No patch is available at present.

The CVSS score of 9.3 indicates critical risk. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an attacker who already possesses a regular Capgo full API key; with that key the attacker can directly write to the exposed table via PostgREST. Because no vendor mitigation exists yet, users that store or expose full API keys remain at high risk. The vulnerability enables bypassing authentication controls and enforcing SSO on arbitrary domains, potentially granting unauthorized login and service disruption.