EUVD-2026-75414
GHSA-g597-pqh2-2fw7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
A valid full API key is required so PR:L not PR:N; impact is forged trusted config (I:H) and login disruption for arbitrary domains (A:H), with negligible confidentiality (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route (supabase/functions/_backend/private/sso/providers.ts) and its controls: the Enterprise plan requirement, SSO provider creation via the Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports {"has_sso": true, "enforce_sso": true} for domains that were never verified, allowing attacker-controlled SSO enforcement to be asserted for arbitrary domains and disrupting normal login. All versions are affected; at the time of the advisory no patch was available.
AnalysisAI
Improper access control in Capgo (capgo.app) lets any holder of an ordinary full API key forge a trusted SSO provider by writing directly to the public.sso_providers table exposed via Supabase PostgREST, setting status='active' and enforce_sso=true without passing the backend provisioning route. This sidesteps the Enterprise-plan gate, Supabase Management API provider creation, DNS TXT domain-ownership verification, and the pending_verification→verified→active workflow, so an attacker can assert SSO enforcement for arbitrary unverified domains and disrupt normal login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid ordinary Capgo full API key (any registered account) and requires that the public.sso_providers table remain directly writable through Supabase PostgREST - the default condition described, since no authorization restricts writes to the backend route. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.3 is driven by AV:N/AC:L/PR:N with high VC/VI/VA, but the description makes clear the attacker must already hold a valid Capgo full API key, so PR:N overstates the precondition - this is authenticated abuse (realistically PR:L), not fully anonymous exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, so the fix must come from tightening data-layer authorization: revoke INSERT/UPDATE/DELETE on public.sso_providers from the anon and authenticated PostgREST roles and enforce Row Level Security that permits writes only from the privileged service-role used by the backend provisioning function, forcing all provider creation back through supabase/functions/_backend/private/sso/providers.ts (trade-off: legitimate provider operations must all flow through that route, which is the intended design anyway). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all active API keys in Capgo, immediately revoke any that are not actively required for production, and review the public.sso_providers table for unauthorized or unrecognized entries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authorization bypass in Capgo (capgo.app), a live-update/OTA platform for Capacitor mobile apps, allows a de-provisioned
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Privilege escalation in the Capgo (capgo.app) backend through version 12.242.4 allows an authenticated API key holder to
Capgo's MFA enforcement is defeated by an authentication assurance level (AAL) mismatch across two distinct code paths:
Unauthenticated organization enumeration in Capgo before 12.128.2 lets attackers abuse the Supabase PostgREST SECURITY D
Unauthenticated denial of service in Cap-go capgo (capgo-backend) before 12.128.12 allows remote attackers to exhaust Po
Cross-tenant billing log tampering in Capgo (Cap-go/capgo) before 12.128.2 allows unauthenticated attackers holding only
Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an exte
Account takeover in Cap-go (Capgo) versions prior to 12.128.2 allows an attacker holding a temporary authenticated sessi
SQL injection in Capgo (cap-go) before 12.128.2 allows authenticated users with read-level API keys to access analytics
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today