EUVD-2026-38101
GHSA-c8g9-cm5m-77px
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, low-privilege attacker account required (PR:L), victim's first SSO login is the user interaction (UI:R), scope changes to the federated IdP-bound identity (S:C), high C/I on hijacked tenant.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.
AnalysisAI
Account takeover in Capgo before 12.128.12 allows authenticated low-privileged users to hijack other users' SSO identities by abusing the SSO provisioning endpoint's reliance on a user-mutable email field as an account-merge key. By updating their own public.users.email to a target's corporate SSO address before the victim's first SSO login, an attacker causes the provision-user flow to merge the victim's federated identity into the attacker-controlled account. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Capgo is an open-source live-update platform for Capacitor mobile apps that uses a Supabase-style backend; the public.users table stores user profile fields, including email, that authenticated users can write to. The SSO provisioning endpoint (provision-user) consumes the corporate SSO identity provider assertion and merges or links the federated identity to an existing local account whose email matches the assertion's email claim. This is a classic CWE-639 (Authorization Bypass Through User-Controlled Key) pattern: a mutable, user-controlled attribute (public.users.email) is treated as a trust anchor for identity linking instead of an immutable, IdP-verified subject identifier (such as the SSO sub/oid claim or a separately verified email). The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, covering all Capgo releases prior to 12.128.12.
RemediationAI
Upgrade to Capgo 12.128.12 or later, which is the vendor-released patch referenced in GHSA-wqc6-fhwf-qpww. Until the upgrade is applied, operators of self-hosted Capgo who use corporate SSO should temporarily disable the provision-user / SSO auto-provisioning endpoint and provision SSO identities out-of-band (this blocks new SSO onboarding but prevents the merge), or apply a database-level restriction that prevents users from updating public.users.email to addresses in any SSO-claimed corporate domain (this breaks legitimate self-service email changes for those domains). Auditing public.users for accounts whose email matches a corporate SSO domain but whose creation predates that user's first SSO login is recommended to detect pre-positioning before patching. Consult the advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-wqc6-fhwf-qpww for upstream remediation details.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today