Capgo CVE-2026-100612

Exploitation requires that the attacker already holds the org_admin tier permission (org.update_settings) within the target organization AND that the organization has an active SSO provider configured. The concrete flaw is that migration 20260826100000_sso_providers_block_direct_active_insert.sql's BEFORE UPDATE guard freezes only dns_verified_at, domain, status and enforce_sso - leaving provider_id (plus metadata_url and attribute_mapping) writable - while the table's ALL grant to the anon/authenticated roles and the row-scoped RLS policy allow_org_admins_update_sso_providers impose no column-level restriction, so an org_admin can PATCH provider_id over PostgREST. Limiting factors: no unauthenticated path (PR:H - a valid org_admin account is mandatory), the org must have SSO actively configured, and the attacker must control an IdP able to assert the owner's email; there is no patched version, so mitigation requires column-level grants/RLS or removing the ALL grant.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, score 8.6) is internally consistent with the description: exploitation is fully network-reachable over PostgREST with low complexity, but is gated behind PR:H - the attacker must already hold the org_admin tier permission (org.update_settings). This is a genuine impact chain (org_admin → org owner/super_admin account takeover) rather than a high-CVSS-but-hollow issue, but the PR:H prerequisite plus the requirement that the target org has an active SSO provider configured materially narrows the real-world attacker population to insiders/compromised admins within SSO-enabled organizations. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation - this is a targeted, precondition-heavy escalation, not a mass-exploitable flaw. The one signal that raises urgency is that no patched version is available (through 12.261.0), leaving affected orgs with no clean remediation. Note the tag 'Authentication Bypass' vs CWE-639 (authorization/IDOR): the root cause is missing column-level authorization, though the ultimate effect is indeed an SSO authentication bypass, so both framings are defensible.

An attacker who already holds org_admin in a Capgo organization that has an active SSO provider issues a PostgREST PATCH against public.sso_providers, rewriting the still-writable provider_id to an identity provider they control (the BEFORE UPDATE guard freezes dns_verified_at/domain/status/enforce_sso but not provider_id). They then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's identity to the owner account, nulls its password, and deletes the owner's other identities and sessions. No public exploit code is identified at time of analysis.