CVE-2026-56215: Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.12 - Configuration
Prevent authenticated users from modifying public.users.email or mark public.users.email as immutable; ensure the provisioning endpoint does not accept user-modified public.users.email as an account-merge key.
Capgo SSO provisioning / public.users.email public.users.email (user-modifiable) = immutable / not trusted for account-merge - Configuration
Change the account-merge logic to rely on an immutable identifier from the SSO identity provider (for example the subject or a stable federated ID) rather than the public.users.email field supplied/owned by users.
Capgo SSO provisioning account-merge key = use immutable SSO identifier (IdP-provided) instead of user-controlled email - Compensating control
Require server-side verification of any email used for account-merge (match against verified IdP assertion) or restrict account-merge operations to administrative or policy-controlled workflows until fixes are applied.
- Operational
Audit recent provisioning and account-merge events to detect and remediate any accounts that may have been merged improperly; revert unauthorized merges and notify affected users and administrators.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56215?
CVE-2026-56215 has a high severity rating of 8.3.
How do I fix CVE-2026-56215?
To fix CVE-2026-56215, update Capgo to version 12.128.13 or later where the vulnerability is addressed.
What are the potential impacts of CVE-2026-56215?
CVE-2026-56215 allows attackers to merge accounts by modifying public.users.email to a victim's email, potentially leading to unauthorized access.
Who is affected by CVE-2026-56215?
Authenticated users of Capgo before version 12.128.13 can be affected by CVE-2026-56215.
How does CVE-2026-56215 exploit the system?
CVE-2026-56215 exploits the trust in the public.users.email field as an account-merge key in the SSO provisioning endpoint.