CVE-2026-56215 | BDVDB-2026-341860 Detail

Description#

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-20Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.