Vulnerability · Published Jul 12, 2026 · Assigned by VulnCheck

CVE-2026-56313Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint

High 8.1

In plain English

A high-severity security flaw in Capgo from Capgo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delete password identities of users in foreign organizations. Attackers with org.update_settings permission and an active SSO provider can call the prelink-users endpoint to permanently remove email-based authentication for any user matching the provider's email domain, forcing victims to use the attacker's SSO provider or complete password reset recovery.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-x3vq-34gg-cwq7) vendor-advisory
VulnCheck Advisory: Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint third-party-advisory