Executive brief
Capgo, a platform for managing app updates, contained a flaw in how it handles Single Sign-On (SSO) logins. An attacker could change their own profile email to match a victim's corporate email address, tricking the system into merging the two accounts. If successful, the attacker gains full control over the victim's account and corporate identity within the platform, leading to unauthorized access to sensitive data and operations.
Technical details
A trust boundary mismatch exists in Capgo's SSO provisioning flow. While 'auth.users.email' is a trusted identity field, 'public.users.email' is a mutable profile field controlled by the user. The '/private/sso/provision-user' endpoint incorrectly uses the mutable 'public.users.email' as the primary lookup key when merging accounts during SSO provisioning. An authenticated attacker can update their profile email to match a target victim's corporate SSO email. When the victim subsequently logs in via SSO, the system resolves the attacker's account as the canonical identity, merges the victim's SSO identity into the attacker's account, and deletes the victim's original SSO user record. This results in a full account takeover. The issue is fixed in version 12.128.12.
Affected products
- Capgo Capgo < 12.128.12
Timeline
- 2026-05-08: advisory: GitHub advisory published by maintainers
- 2026-06-20: disclosed: NVD publication date