CVE-2026-56215: Capgo Authentication Bypass Vulnerability

CVE-2026-56215 Overview

CVE-2026-56215 affects Capgo versions before 12.128.12. The flaw allows authenticated users to modify the mutable public.users.email field to arbitrary values. The Single Sign-On (SSO) provisioning endpoint trusts this attribute as an account-merge key without independent verification. An attacker can pre-position an account with a victim's corporate SSO email address. When the victim authenticates through SSO, the provision-user endpoint merges the victim's SSO identity into the attacker-controlled account. The issue is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can hijack victim SSO identities by poisoning a user-controlled email field, gaining unauthorized access to merged accounts and their associated data.

Affected Products

Capgo versions prior to 12.128.12
Self-hosted Capgo deployments using SSO provisioning
Capgo SaaS instances on vulnerable builds

Discovery Timeline

2026-06-20 - CVE-2026-56215 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56215

Vulnerability Analysis

The vulnerability resides in how Capgo handles account identity reconciliation during SSO provisioning. The application stores user email in the public.users.email column and exposes mutation of that column to authenticated end users. The SSO provisioning endpoint subsequently uses this same email value as the lookup key to determine whether an incoming SSO identity should be merged into an existing local account.

Because the email attribute is user-controlled and not cryptographically bound to a verified identity, the provisioning logic cannot distinguish between a legitimately owned email and one set by an attacker. This breaks the trust boundary between authenticated user data and the SSO identity merge process. The result is a business logic flaw enabling cross-account takeover at provisioning time.

Root Cause

The root cause is treating a mutable, user-writable attribute as an authoritative identifier. The schema permits any authenticated user to update public.users.email without proof of ownership through verification challenges. The provisioning service then queries this column as if it were an immutable, verified identity key.

Attack Vector

The attack proceeds over the network and requires only low-privileged authenticated access. An attacker registers an account on the target Capgo instance. The attacker updates their public.users.email to the corporate SSO email of a targeted victim. When the victim later signs in through their corporate identity provider, the provision-user endpoint matches the SSO assertion against the poisoned email and merges the victim's SSO identity into the attacker-controlled account. The attacker retains login credentials and inherits the victim's identity context.

The vulnerability is described in prose because no verified proof-of-concept code is published. Technical details are available in the GitHub Security Advisory and the VulnCheck Advisory on CapGo.

Detection Methods for CVE-2026-56215

Indicators of Compromise

Updates to public.users.email from authenticated sessions where the new value matches a corporate SSO domain not previously associated with the account.
SSO provisioning events that merge an external identity into a local account whose email was changed within a short window before the merge.
Multiple distinct user IDs sharing or rotating the same email value over a short period.

Detection Strategies

Audit application logs for UPDATE statements against public.users.email and correlate with subsequent SSO provisioning calls for the same account.
Flag account-merge operations where the local account's email was modified within a defined threshold prior to the SSO assertion.
Compare the email domain of an account before merge against the SSO assertion's issuing domain and alert on mismatched ownership history.

Monitoring Recommendations

Forward Capgo application and database audit logs to a centralized analytics platform for correlation across email change and SSO provisioning events.
Alert on bulk email changes targeting domains that map to known SSO tenants.
Track account-merge outcomes and verify that the post-merge owner matches the verified identity provider subject claim.

How to Mitigate CVE-2026-56215

Immediate Actions Required

Upgrade Capgo to version 12.128.12 or later on all production and staging deployments.
Audit historical email changes and SSO merges since the deployment of vulnerable versions and revoke sessions for suspect accounts.
Force re-verification of email addresses for accounts whose public.users.email was modified prior to patch deployment.

Patch Information

The maintainers addressed the issue in Capgo 12.128.12. The fix decouples user-mutable email from the SSO account-merge key and enforces verified ownership before merging an SSO identity into an existing account. Refer to the GitHub Security Advisory for release notes and commit references.

Workarounds

Disable self-service email modification for authenticated users until the upgrade is applied.
Require an email verification challenge before any change to public.users.email takes effect.
Restrict the SSO provisioning endpoint to match identities only on immutable, provider-issued subject identifiers rather than on email.

bash

# Configuration example
# Pin Capgo to the patched release in your deployment manifest
image: capgo/capgo:12.128.12