Executive brief
Capgo, a platform for managing app updates, contained a flaw that allowed administrators of one organization to disrupt accounts in entirely different organizations. By exploiting the Single Sign-On (SSO) setup process, a malicious administrator could delete the password-based login credentials of any user whose email domain matched their own. This results in legitimate users being locked out of their accounts, forcing them to either use the attacker's SSO system or undergo a manual password recovery process.
Technical details
A vulnerability in the SSO prelink-users endpoint of Capgo (prior to version 12.128.2) allowed for improper authorization (CWE-285). The root cause was located in the prelink-internal.ts component, which used an administrative function to list all platform users and filter them by email domain without verifying their organization membership. An attacker with 'org.update_settings' permissions and a DNS-verified SSO provider could trigger this endpoint to delete the 'email' identity (password authentication) for any user on the platform sharing that domain. This effectively forces cross-tenant account disruption, as victims lose their primary authentication method and are redirected to an SSO provider they may not have access to. The issue was resolved by adding organization membership checks to the prelink logic.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: Initial GitHub Security Advisory published
- 2026-07-12: disclosed: CVE published and NVD record created