CVE-2026-100612: Capgo access control bypass in SSO provider configuration

CVE-2026-100612 · Severity: high · CVSS 7.2 · Published 2026-09-26

Capgo, a mobile application platform, has a flaw in its single sign-on (SSO) configuration that allows organization administrators to redirect authentication to an attacker-controlled identity provider. By manipulating which identity provider a domain trusts, an attacker with admin privileges can impersonate the organization owner, take over their account, and lock them out. The vulnerability requires the attacker to already hold admin access within the target organization and for SSO to be configured.

Technologies: Capgo. Vendors: Capgo.

Quick answers

Is CVE-2026-100612 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-100612 being exploited in the wild.
How severe is CVE-2026-100612?
High severity, with a CVSS score of 7.2, published 26 September 2026.
Which products and versions are affected?
Capgo through 12.261.0.
Is there a fix for CVE-2026-100612?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100612 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-100612?
Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from incomplete row-level security enforcement in PostgreSQL: the public.sso_providers table has a BEFORE UPDATE guard that freezes certain columns (dns_verified_at, domain, status, enforce_sso) but leaves provider_id, metadata_url, and attribute_mapping writable. Since PostgreSQL RLS policies constrain only which rows may be updated rather than which columns within those rows, an org_admin can PATCH the provider_id column via PostgREST to point to an attacker-controlled IdP. This breaks the trust anchor binding email domains to authorized providers, allowing authentication bypass and account takeover via identity merge.

Affected products

  • Capgo Capgo through 12.261.0

Timeline

  • 2026-09-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.