CVE-2026-56215 Details
Description
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.
A vulnerability in Capgo versions prior to 12.128.12 allows authenticated users to arbitrarily modify their public email address in the user profile. This mutable email is then trusted by the Single Sign-On (SSO) provisioning endpoint as a key for merging accounts. Attackers can exploit this by replacing their email with that of a victim's corporate SSO address. When the victim later logs in through SSO, the system merges their identity into the attacker's account, effectively transferring SSO-related privileges and access.
Users can update their public email back to a trusted address after testing. However, the underlying issue requires a change in how the SSO provisioning process handles email verifications and merges.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 20, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-wqc6-fhwf-qpww | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-wqc6-fhwf-qpww | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/capgo-account-merge-via-poisoned-public-users-email-in-sso-provisioning | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 20, 2026 | New CVE Received | [email protected] |