Cross-Organization Account Disruption in Capgo via SSO

Compliance Impact

The vulnerability allows enterprise administrators to delete password identities of users in foreign organizations without proper authorization, which can lead to unauthorized access disruptions and potential data access issues.

Such unauthorized account disruptions and forced use of an attacker's SSO provider or password reset recovery could impact compliance with standards like GDPR and HIPAA, which require strict controls on user data access, identity management, and protection against unauthorized actions.

Specifically, improper authorization and cross-organization account disruptions may violate principles of data minimization, user consent, and security controls mandated by these regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56313 is a vulnerability in Capgo versions before 12.128.2 that affects the Single Sign-On (SSO) prelink endpoint. It allows enterprise administrators who have the org.update_settings permission and an active SSO provider to delete password identities of users belonging to other organizations.

The flaw occurs because the system does not properly check if users belong to the administrator's organization before deleting their email-based authentication identities. Instead, it deletes identities for all users matching the SSO provider's email domain, regardless of organization membership.

As a result, attackers can permanently remove email/password authentication for users in foreign organizations, forcing those users to either use the attacker's SSO provider or go through a password reset recovery process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt user access across organizations by allowing an attacker with certain administrative permissions to delete email-based authentication identities of users outside their own organization.

Affected users will be forced to either authenticate using the attacker's SSO provider, which they may not have access to, or complete a password reset recovery process to regain access to their accounts.

This can lead to significant account disruption, potential denial of service for legitimate users, and increased administrative overhead to recover affected accounts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves misuse of the SSO prelink endpoint by enterprise administrators with org.update_settings permission and an active SSO provider. Detection would involve monitoring calls to the /sso/prelink-users endpoint, especially those that trigger deletion of email-based authentication identities for users outside the administrator's organization.

Commands or monitoring steps could include inspecting logs for unusual API calls to /sso/prelink-users, particularly those initiated by admins with org.update_settings permission. Additionally, reviewing audit logs for deletion of password identities for users from foreign organizations could help detect exploitation attempts.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Capgo to version 12.128.2 or later, where the vulnerability has been patched.

Until the patch is applied, restrict or monitor the use of the SSO prelink endpoint, especially limiting org.update_settings permissions to trusted administrators only.

Review and audit active SSO providers and their configurations to ensure no unauthorized domains are linked.

Useful 0 Not Useful 0