CVE-2026-56223: Capgo Auth Bypass Vulnerability

CVE-2026-56223 Overview

CVE-2026-56223 is a cross-domain Single Sign-On (SSO) account takeover vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the provision-user endpoint, which merges accounts based on email address matching without validating whether the asserting Identity Provider (IdP) is authorized for the target email domain. An attacker holding enterprise organization admin access and operating a malicious IdP can forge Security Assertion Markup Language (SAML) assertions containing a victim's email address. The forged assertion triggers an account merge, granting the attacker full access to the victim's account, organization, and data. The weakness is classified under [CWE-287: Improper Authentication].

Critical Impact
Attackers with enterprise admin privileges and a controlled IdP can take over arbitrary Capgo accounts across domain boundaries, breaching organizational isolation.

Affected Products

Capgo versions prior to 12.128.2
Deployments using SAML-based SSO via the provision-user endpoint
Multi-tenant enterprise organizations sharing the platform

Discovery Timeline

2026-06-24 - CVE-2026-56223 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56223

Vulnerability Analysis

The vulnerability stems from a broken trust boundary in Capgo's SSO provisioning flow. When the provision-user endpoint receives a SAML assertion, it locates existing accounts by matching the asserted email address. The endpoint does not verify that the asserting IdP has authoritative control over the email domain in the assertion. An attacker can register an enterprise organization, configure a malicious IdP under their control, and emit SAML assertions naming any victim email. The application accepts the assertion and merges the malicious identity into the victim's existing account.

The outcome is a full cross-tenant account takeover. The attacker inherits the victim's session context, organizational membership, and data access without ever interacting with the legitimate IdP or knowing the victim's credentials.

Root Cause

The root cause is missing domain-to-IdP authorization binding. The application treats any successfully signed SAML assertion from any configured tenant IdP as authoritative for the asserted email, regardless of which domain that email belongs to. No mapping enforces that victim@example.com may only be asserted by the IdP registered for example.com.

Attack Vector

Exploitation requires network access to the Capgo SSO endpoint and high privileges in the form of enterprise organization admin rights to register a malicious IdP. User interaction is not required. The attack flow is:

The attacker provisions an enterprise org and connects a malicious IdP.
The attacker crafts a SAML assertion populated with a victim's email.
The attacker submits the assertion to the provision-user endpoint.
The backend matches the email to the victim's account and merges identities.
The attacker authenticates and inherits the victim's privileges and data.

Refer to the GitHub Security Advisory GHSA-jhjh-vp9p-54fg and the VulnCheck Advisory on Account Takeover for additional technical context.

Detection Methods for CVE-2026-56223

Indicators of Compromise

Account merge events on the provision-user endpoint where the asserting IdP's registered domain does not match the asserted email domain.
SAML assertions referencing email addresses outside the issuing organization's verified domains.
Unexpected new IdP registrations followed shortly by provisioning calls naming external users.
Sudden changes in organization membership or role for established user accounts.

Detection Strategies

Audit historical provision-user requests and correlate the asserting IdP identifier with the email domain in each assertion.
Alert when a single IdP issues assertions for multiple, unrelated email domains.
Review identity merge logs for any event linking a pre-existing account to a newly registered enterprise tenant.

Monitoring Recommendations

Forward Capgo authentication, SSO, and audit logs to a centralized SIEM for cross-tenant correlation.
Track enterprise org admin actions, particularly IdP creation and metadata changes, in near real time.
Monitor for privilege escalation patterns immediately following IdP configuration changes.

How to Mitigate CVE-2026-56223

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later without delay.
Review all enterprise IdP registrations and remove any that lack verified domain ownership.
Audit recent account merges and force re-authentication for affected users.
Rotate API tokens and session credentials for any account suspected of being merged.

Patch Information

The vendor addressed the issue in Capgo 12.128.2. The fix enforces a binding between the asserting IdP and the email domain being asserted, so the provision-user endpoint refuses assertions where the IdP is not authoritative for the email domain. Patch details are published in the GitHub Security Advisory GHSA-jhjh-vp9p-54fg.

Workarounds

Restrict the ability to create enterprise organizations and register IdPs to trusted administrators only.
Disable the SAML-based provision-user flow until the upgrade is applied if feasible.
Require manual administrative approval before any cross-organization account merge.