# CVE-2026-56313: Capgo improper authorization in SSO prelink endpoint

Source: https://junglewise.ai/threats/cve-2026-56313-capgo-improper-authorization-in-sso-prelink-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-12. Updated: 2026-07-12  
License: CC BY 4.0 with a link back

CVE-2026-56313 · Severity: high · CVSS 8.1 · Published 2026-07-12

Capgo, a platform for managing app updates, contained a flaw that allowed administrators of one organization to disrupt accounts in entirely different organizations. By exploiting the Single Sign-On (SSO) setup process, a malicious administrator could delete the password-based login credentials of any user whose email domain matched their own. This results in legitimate users being locked out of their accounts, forcing them to either use the attacker's SSO system or undergo a manual password recovery process.

Technologies: [Capgo](https://junglewise.ai/threats/technologies/capgo). Vendors: [Capgo](https://junglewise.ai/threats/vendors/capgo).

## Quick answers

**Is CVE-2026-56313 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56313 being exploited in the wild.

**How severe is CVE-2026-56313?** High severity, with a CVSS score of 8.1, published 12 July 2026.

**Which products and versions are affected?** Capgo < 12.128.2.

**Is there a fix for CVE-2026-56313?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56313 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-56313?** Check whether you run Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the SSO prelink-users endpoint of Capgo (prior to version 12.128.2) allowed for improper authorization (CWE-285). The root cause was located in the prelink-internal.ts component, which used an administrative function to list all platform users and filter them by email domain without verifying their organization membership. An attacker with 'org.update_settings' permissions and a DNS-verified SSO provider could trigger this endpoint to delete the 'email' identity (password authentication) for any user on the platform sharing that domain. This effectively forces cross-tenant account disruption, as victims lose their primary authentication method and are redirected to an SSO provider they may not have access to. The issue was resolved by adding organization membership checks to the prelink logic.

## Affected products

- Capgo Capgo < 12.128.2

## Timeline

- 2026-05-07: advisory: Initial GitHub Security Advisory published
- 2026-07-12: disclosed: CVE published and NVD record created

## References

- [https://github.com/Cap-go/capgo/security/advisories/GHSA-x3vq-34gg-cwq7](https://github.com/Cap-go/capgo/security/advisories/GHSA-x3vq-34gg-cwq7)
- [https://www.vulncheck.com/advisories/capgo-cross-organization-account-disruption-via-sso-prelink-endpoint](https://www.vulncheck.com/advisories/capgo-cross-organization-account-disruption-via-sso-prelink-endpoint)

## Related threats

- [Capgo access control bypass in SSO provider configuration](https://junglewise.ai/threats/cve-2026-100612-capgo-capgo-app-through-version-12-261-0-contains-an-incomplete)
- [Capgo information disclosure in SSO check-domain endpoint](https://junglewise.ai/threats/cve-2026-56336-capgo-information-disclosure-in-sso-check-domain-endpoint)
- [Capgo insufficient authentication in email change endpoint](https://junglewise.ai/threats/cve-2026-56308-capgo-insufficient-authentication-in-email-change-endpoint)
- [Capgo SQL injection in admin_stats endpoint](https://junglewise.ai/threats/cve-2026-56281-capgo-sql-injection-in-admin-stats-endpoint)
- [Capgo incorrect authorization in webhook test endpoint](https://junglewise.ai/threats/cve-2026-56252-capgo-incorrect-authorization-in-webhook-test-endpoint)