Executive brief
Capgo, a platform for managing app updates and deployments, suffered from a flaw in how it handles Single Sign-On (SSO) logins. An attacker with administrative access to their own enterprise account could use a malicious identity provider to impersonate any other user on the platform. This allows the attacker to take full control of victim accounts, gaining access to sensitive application data, organizational settings, and connected devices.
Technical details
A vulnerability in the `provision-user.ts` endpoint of Capgo allows for cross-domain account takeover via improper SSO identity merging. The root cause is a failure to validate that the authenticating SSO provider is authorized for the victim's email domain during the account merge process. An attacker with enterprise organization admin privileges can configure a malicious Identity Provider (IdP) to forge SAML assertions containing a victim's email address. When the attacker authenticates, the system identifies an existing account with that email and merges the attacker's SSO identity into the victim's account without verifying domain ownership. This grants the attacker full access to the victim's profile, organizations, and data. The issue is fixed in version 12.128.2.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date