CVE-2026-56223: Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56223?
The severity of CVE-2026-56223 is rated high with a CVSS score of 8.7.
How do I fix CVE-2026-56223?
To fix CVE-2026-56223, update your Capgo software to version 12.128.2 or later.
What does CVE-2026-56223 exploit?
CVE-2026-56223 exploits a cross-domain SSO vulnerability that allows account takeover via the provision-user endpoint.
Who is affected by CVE-2026-56223?
Organizations using Capgo versions prior to 12.128.2 are affected by CVE-2026-56223, particularly those with enterprise org admin access.
What is the impact of CVE-2026-56223?
The impact of CVE-2026-56223 includes the possibility of account takeover through the merging of victim accounts based on email match.