CVE-2026-88864: Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
Capgo (capgo.app) fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route (supabase/functions/backend/private/sso/providers.ts) and its controls: the Enterprise plan requirement, SSO provider creation via the Supabase Management API, DNS TXT domain-ownership verification, the pendingverification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports {"hassso": true, "enforcesso": true} for domains that were never verified, allowing attacker-controlled SSO enforcement to be asserted for arbitrary domains and disrupting normal login. All versions are affected; at the time of the advisory no patch was available.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an ordinary Capgo full API key. No user interaction is required.
Can an attacker enforce SSO for a domain they do not control?
Yes. The direct write can create an active, enforced SSO provider entry without DNS TXT domain-ownership verification or the intended verification status progression.
What is the practical impact on affected tenants?
Attacker-created provider records are trusted by SSO discovery and enforcement logic, including the unauthenticated domain preflight endpoint. This can assert SSO enforcement for arbitrary domains and disrupt normal login.
Is there an unaffected version or vendor patch available?
No. All versions are affected, and no patch was available at the time of the advisory.