CVE-2026-56223: Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user

Published Jun 24, 2026
·
Updated

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data.

Affected Software

1 affected component
Capgo Capgo<12.128.2

Event History

Jun 24, 2026
CVE Published
via MITRE·11:53 AM
Data Sourced
via MITRE·11:53 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2026-56223?

The severity of CVE-2026-56223 is rated high with a CVSS score of 8.7.

2

How do I fix CVE-2026-56223?

To fix CVE-2026-56223, update your Capgo software to version 12.128.2 or later.

3

What does CVE-2026-56223 exploit?

CVE-2026-56223 exploits a cross-domain SSO vulnerability that allows account takeover via the provision-user endpoint.

4

Who is affected by CVE-2026-56223?

Organizations using Capgo versions prior to 12.128.2 are affected by CVE-2026-56223, particularly those with enterprise org admin access.

5

What is the impact of CVE-2026-56223?

The impact of CVE-2026-56223 includes the possibility of account takeover through the merging of victim accounts based on email match.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203