Executive brief
Capgo, a tool used for managing app updates and deployments, contains a flaw in its Single Sign-On (SSO) domain check feature. An unauthorized person can query the system to reveal internal organization and provider identifiers associated with specific email domains. While this does not grant direct access to customer data, it allows attackers to map out corporate structures and identify which security providers a company uses, which can be used to plan more targeted phishing or social engineering attacks.
Technical details
An information disclosure vulnerability exists in the Capgo backend due to the exposure of unnecessary internal fields in the SSO domain verification endpoint. The '/private/sso/check-domain' endpoint, which is intentionally unauthenticated to allow the login page to detect SSO requirements, returns 'org_id' and 'provider_id' UUIDs that are not consumed by the frontend client. An attacker can exploit this by sending POST requests with various email domains to the endpoint. By rotating source IPs to bypass the basic rate limiting, an adversary can perform bulk reconnaissance to map domains to internal organization identifiers and identify configured SSO providers. The issue is resolved in version 12.128.2 by removing these unused fields from the JSON response.
Affected products
- Capgo Capgo before 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published by vendor
- 2026-07-12: disclosed: CVE published to NVD dataset
- 2026-07-12: patched: Fix confirmed in version 12.128.2