Vulnerability · Published Jun 24, 2026 · Assigned by VulnCheck

CVE-2026-56223Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user

High 8.7

In plain English

A high-severity improper authentication in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and gain full access to victim accounts, organizations, and data.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-jhjh-vp9p-54fg) vendor-advisory
VulnCheck Advisory: Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user third-party-advisory