CVE-2026-56313 Overview
CVE-2026-56313 is an improper authorization vulnerability [CWE-285] in Capgo versions prior to 12.128.2. The flaw resides in the Single Sign-On (SSO) prelink endpoint, which fails to enforce organizational boundaries when processing prelink requests. Enterprise administrators holding the org.update_settings permission and an active SSO provider can invoke the prelink-users endpoint to strip password-based authentication from users in foreign organizations. Any account whose email matches the attacker's configured SSO domain becomes a target. Victims lose email-based login access and are forced through the attacker's SSO provider or a password reset recovery workflow.
Critical Impact
Attackers with low-privilege administrative access in one organization can permanently disable password authentication for users across unrelated organizations sharing the same email domain.
Affected Products
- Capgo versions prior to 12.128.2
- Deployments with SSO prelink functionality enabled
- Multi-tenant Capgo instances hosting enterprise organizations
Discovery Timeline
- 2026-07-12 - CVE-2026-56313 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-56313
Vulnerability Analysis
The vulnerability exists in Capgo's SSO prelink endpoint, which processes requests to link password identities to SSO providers. The endpoint verifies that the caller holds the org.update_settings permission within their own organization but does not verify that targeted users belong to that same organization. An authenticated administrator can therefore submit prelink requests referencing email addresses owned by users in other tenants.
When the endpoint processes a matching email, it removes the password identity from the target account. The victim can no longer authenticate using their existing credentials. Recovery requires either authenticating through the attacker's SSO provider, potentially exposing session data to the attacker, or completing a full password reset flow.
Root Cause
The root cause is missing cross-tenant authorization enforcement [CWE-285]. The prelink-users endpoint scopes permission checks to the calling administrator's organization but applies mutations to any user matching the SSO provider's email domain. Email domain matching alone determines which accounts get modified, with no verification that those accounts belong to the caller's tenant.
Attack Vector
Exploitation requires network access to the Capgo API and an authenticated session with org.update_settings privileges in any organization. The attacker configures an SSO provider whose email domain matches the target users. Calling the prelink-users endpoint then triggers deletion of password identities for every matching email address across the platform. The attack requires no user interaction from victims and produces persistent authentication disruption.
Code-level exploitation details are described in the GitHub Security Advisory and the VulnCheck Security Advisory.
Detection Methods for CVE-2026-56313
Indicators of Compromise
- Unexpected calls to the SSO prelink-users endpoint originating from administrators of unrelated organizations
- User accounts showing password identity removal events without corresponding user-initiated actions
- SSO provider configurations created with email domains that do not match the configuring organization's registered domains
- User complaints reporting sudden inability to sign in with previously valid credentials
Detection Strategies
- Audit application logs for prelink endpoint invocations and correlate the target user's organization with the caller's organization to flag cross-tenant activity
- Alert on newly registered SSO providers whose email domain does not match the owning organization's verified domain list
- Monitor authentication identity tables for bulk deletions of password credentials within short time windows
Monitoring Recommendations
- Forward Capgo API and authentication logs to a centralized SIEM or data lake for cross-tenant correlation and long-term retention
- Track a baseline of expected prelink operations per organization and alert on statistical deviations
- Review password reset volumes for spikes that may indicate mass identity removals from this vulnerability
How to Mitigate CVE-2026-56313
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later without delay
- Review recent SSO provider configurations and revoke any created by administrators lacking a legitimate business need
- Audit password identity deletion events since the deployment of any vulnerable version and restore affected accounts
- Restrict the org.update_settings permission to a minimal set of verified administrators
Patch Information
Capgo resolved the vulnerability in version 12.128.2. The fix enforces that prelink operations only affect users within the caller's organization. Details are published in the GitHub Security Advisory GHSA-x3vq-34gg-cwq7.
Workarounds
- If immediate patching is not feasible, disable the SSO prelink endpoint at the reverse proxy or API gateway layer
- Temporarily require domain ownership verification before allowing SSO provider creation with a given email domain
- Reduce the number of accounts holding org.update_settings until upgrade is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
