CVE-2026-100612: Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.ssoproviders table. Migration 20260826100000ssoprovidersblockdirectactiveinsert.sql installs a BEFORE UPDATE guard (enforcessoproviderclientupdateguard()) that freezes only the dnsverifiedat, domain, status and enforcesso columns; providerid (as well as metadataurl and attributemapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as alloworgadminsupdatessoproviders constrain only which row may be updated and not which columns, a user holding the orgadmin tier permission org.updatesettings can PATCH providerid over PostgREST to an identity provider under their control. Since providerid is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from orgadmin to org owner/superadmin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds orgadmin in that organization. No patched version is available.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with the org_admin tier permission org.update_settings for the target organization. The described path uses PostgREST to update an SSO-provider row the attacker is authorized to modify.
What access is affected after exploitation?
The attacker can point the provider_id to an identity provider they control and assert the organization owner's email. The SSO merge routine then attaches the attacker's SSO identity to the existing owner account, nulls that account's password, and deletes its other identities and session data.
Why do row-level security policies not prevent the bypass?
The relevant row-level security policy restricts which SSO-provider row an organization administrator may update, not which columns they may change. provider_id remains writable because the update guard freezes only dns_verified_at, domain, status, and enforce_sso.