CVE-2026-56313: Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delete password identities of users in foreign organizations. Attackers with org.updatesettings permission and an active SSO provider can call the prelink-users endpoint to permanently remove email-based authentication for any user matching the provider's email domain, forcing victims to use the attacker's SSO provider or complete password reset recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Configuration
Ensure only trusted administrators with the intended privileges can access/trigger the SSO prelink-users endpoint (limit org.update_settings permission and block access to the prelink-users endpoint as appropriate), to prevent cross-organization deletion of password identities.
SSO prelink endpoint (Capgo) org.update_settings permission / prelink-users endpoint access = restrict
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56313?
CVE-2026-56313 has a severity rating of 8.1, indicating high severity.
How do I fix CVE-2026-56313?
To fix CVE-2026-56313, update Capgo to version 12.128.2 or later.
What does CVE-2026-56313 affect?
CVE-2026-56313 affects the SSO prelink endpoint in versions of Capgo before 12.128.2.
What type of vulnerability is CVE-2026-56313?
CVE-2026-56313 is a cross-organization account disruption vulnerability.
Who is at risk with CVE-2026-56313?
Enterprise administrators with org.update_settings permission using an active SSO provider are at risk from CVE-2026-56313.