CVE-2026-88864
Deferred Deferred - Pending Action

Direct Write Access Bypass in Capgo via Supabase PostgREST

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route (supabase/functions/_backend/private/sso/providers.ts) and its controls: the Enterprise plan requirement, SSO provider creation via the Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports {"has_sso": true, "enforce_sso": true} for domains that were never verified, allowing attacker-controlled SSO enforcement to be asserted for arbitrary domains and disrupting normal login. All versions are affected; at the time of the advisory no patch was available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88864
EUVD
EUVD-2026-75414

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
capgo capgo to 12.262.0 (exc)
capgo capgo *
supabase supabase *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88864 is a vulnerability in Capgo (capgo.app) where an attacker with a full API key can directly write to the public.sso_providers table via Supabase PostgREST. This bypasses critical SSO setup controls like Enterprise plan requirements, DNS verification, and proper status transitions. The attacker can create a fake SSO provider with enforce_sso=true, which is then trusted by SSO discovery endpoints, falsely indicating SSO enforcement for arbitrary domains.

Detection Guidance

Check for unauthorized entries in the public.sso_providers table via Supabase PostgREST. Use SQL queries to inspect the table for rows with status='active' and enforce_sso=true that were not created through the proper backend SSO provisioning route. Example command: SELECT * FROM public.sso_providers WHERE status='active' AND enforce_sso=true AND created_at > '2026-09-10';

Monitor the /private/sso/check-domain endpoint for unexpected SSO enforcement responses on unverified domains. Use curl to test domains: curl https://your-capgo-instance.com/private/sso/check-domain?domain=example.com

Impact Analysis

This vulnerability allows attackers to enforce SSO for domains they do not control, disrupting normal login processes. It can lead to authentication-state poisoning, where unauthorized SSO enforcement is asserted, potentially causing account access issues or enabling further attacks. The impact includes unauthorized access to accounts and disruption of legitimate user authentication.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to improper access control allowing unauthorized SSO enforcement. Attackers could bypass authentication mechanisms, potentially exposing sensitive user data or violating access control requirements.

Mitigation Strategies

Upgrade to capgo-12.262.0 or later to block direct active SSO provider inserts via PostgREST. If upgrading is not possible, restrict write access to the public.sso_providers table by revoking direct API key permissions or implementing row-level security policies.

Audit existing SSO providers by reviewing all entries in public.sso_providers with status='active'. Remove any unauthorized or unverified entries immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88864. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart