CVE-2026-56223
HIGHCapgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
Title source: cnaDescription
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-jhjh-vp9p-54fg)
https://github.com/Cap-go/capgo/security/advisories/GHSA-jhjh-vp9p-54fg
Third Party Advisory third-party-advisory
VulnCheck Advisory: Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
https://www.vulncheck.com/advisories/capgo-account-takeover-via-cross-domain-sso-email-assertion-in-provision-user
Scores
CVSS v3
8.7
EPSS
0.0024
EPSS Percentile
15.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-287
Status
published
Products (2)
Capgo/Capgo
< 12.128.2
Capgo/Capgo
12.128.2
Published
Jun 24, 2026
Tracked Since
Jun 24, 2026