Description

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_mapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's email; the server-side provider match succeeds and the merge routine attaches the attacker's SSO identity to the existing owner account, nulls its password, and deletes its other identities and sessions. This results in vertical privilege escalation from org_admin to org owner/super_admin, account takeover, and lockout of the legitimate owner. Exploitation requires that the target organization has an active SSO provider configured and that the attacker already holds org_admin in that organization. No patched version is available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-26T14:16:41.753Z",
  "pubdate": "2026-09-26T14:16:41.753Z",
  "executiveSummary": "Capgo versions through 12.261.0 contain an incomplete access-control vulnerability in the public.sso_providers table, leading to vertical privilege escalation and unauthorized account takeover.\nThe vulnerability originates from a flawed PostgreSQL trigger that fails to restrict write access to critical columns, specifically the provider_id.\nAn authenticated user with 'org_admin' privileges can manipulate the SSO configuration to bind an attacker-controlled identity provider to the target organization's domain.\nThis allows the attacker to authenticate as any user, including the account owner, by asserting their email address, effectively bypassing authentication mechanisms.\nSuccessful exploitation results in full account compromise, including the nullification of existing passwords and the termination of legitimate user sessions.\nThe vulnerability is exploitable by an existing 'org_admin' user within an organization that has an active SSO provider configured, presenting a critical risk to multi-tenant security architecture.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate enforcement mechanism within the migration script 20260826100000_sso_providers_block_direct_active_insert.sql. The function 'enforce_sso_provider_client_update_guard()' implements a BEFORE UPDATE trigger that incorrectly assumes immutability is only required for 'dns_verified_at', 'domain', 'status', and 'enforce_sso' columns.\nCrucially, the 'provider_id', 'metadata_url', and 'attribute_mapping' columns remain modifiable via the PostgREST interface. Because the public.sso_providers table is granted 'ALL' permissions to 'anon' and 'authenticated' roles without column-level security, and PostgreSQL Row-Level Security (RLS) policies like 'allow_org_admins_update_sso_providers' only gate row access rather than column mutability, an attacker can perform a PATCH request to overwrite these sensitive fields.\nThe attack flow begins when an attacker with the 'org.update_settings' permission identifies the organization's existing SSO provider record. The attacker executes a malicious PATCH request to update the 'provider_id' to an identity provider under their control. By doing so, the attacker modifies the trust anchor used by the application to validate user assertions.\nWhen the attacker subsequently initiates an authentication flow through their malicious IdP and asserts the email address of the organization's owner, the server-side merge routine accepts the assertion as legitimate. The system automatically attaches the attacker's SSO identity to the owner's existing account record.\nPost-exploitation impact is severe: the merge process nullifies the legitimate owner's password, deletes all other associated identities, and invalidates existing sessions. This sequence of operations effectively locks out the original owner while granting the attacker full administrative control over the organization's account.\nThe vulnerability is exacerbated by the lack of column-level restrictions on the database layer and the failure of the 'enforce_sso_provider_client_update_guard' to treat the 'provider_id' as a read-only field after the initial configuration. Since no patch is currently available, the system remains susceptible to this privilege escalation vector as long as 'org_admin' roles are granted to untrusted or potentially compromised accounts."
}