Access Control Bypass in Capgo SSO Providers for Enhanced Privilege Escalation

CVE-2026-100612

What is CVE-2026-100612?

Capgo App before version 12.261.0 exhibits an incomplete access control fix for the public.sso_providers table. The migration script fails to enforce appropriate restrictions on critical columns such as provider_id, granting anonymous and authenticated users excessive permissions. This oversight allows org_admin users to manipulate the provider_id associated with an identity provider, enabling them to authenticate as the legitimate org owner. Consequently, this leads to a complete account takeover by nullifying the owner's password and removing their session data, culminating in unauthorized access to sensitive organizational resources. This exploit necessitates an active SSO configuration in the target organization and an attacker already possessing org_admin credentials.

References