CVE-2026-100612
Received Received - Intake

Privilege Escalation in Capgo via SSO Provider Manipulation

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_mapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from org_admin to org owner/super_admin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds org_admin in that organization. No patched version is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100612
EUVD
EUVD-2026-87707

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
capgo capgo to 12.261.0 (exc)
capgo capgo 12.261.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Capgo through version 12.261.0 allows an attacker with org_admin permissions to escalate privileges to org owner by manipulating the public.sso_providers table. The incomplete access-control fix leaves certain columns writable, enabling an attacker to change the provider_id to one under their control. This allows them to authenticate as the org owner using their own identity provider, take over the account, and lock out the legitimate owner.

Impact Analysis

If you are an org_admin in a Capgo instance using SSO, an attacker could exploit this to take over your organization's account. This could lead to unauthorized access, data breaches, or disruption of services. Legitimate owners may be locked out of their accounts, causing operational issues.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Account takeovers may result in data breaches, exposing personal or health information, leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately revoke org_admin permissions from any untrusted users and audit all org_admin accounts. Disable SSO provider modifications via PostgREST by restricting ALL privileges on the public.sso_providers table to only trusted roles. Review and apply PostgreSQL row-level security policies to enforce column-level restrictions on sso_providers updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart