PT-2026-51045 · Cap Go · Cap-Go

Judel777 · Publicado 2026-06-20 · Atualizado 2026-06-20 · CVE-2026-56215

Mitre

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-56215

Produtos afetados

Cap-Go

Referências · 3

• https://vulncheck.com/advisories/capgo-account-merge-via-poisoned-public-users-email-in-sso-provisioning · Nota
• https://github.com/Cap-go/capgo/security/advisories/GHSA-wqc6-fhwf-qpww · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56215 · Nota de Segurança