CVE-2026-56215CWE-639

Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning

High · published June 20, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-20T00:14Z
EPSS history
Timeline
  • 20 JUN 00:14Z
    Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning
    cvelistv5