PT-2026-51045 · Cap Go · Cap-Go

Judel777 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56215

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.12

Description Authenticated users can modify the mutable public.users.email variable to arbitrary addresses. The SSO provisioning endpoint trusts this value as an account-merge key. This allows an attacker to pre-position an account with a victim's corporate SSO email, leading the 'provision-user' endpoint to merge the victim's SSO identity into the account controlled by the attacker.

Recommendations Update to version 12.128.12 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-56215

Affected Products

Cap-Go

References · 5

• https://github.com/Cap-go/capgo/security/advisories/GHSA-wqc6-fhwf-qpww · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56215 · Security Note
• https://twitter.com/CVEnew/status/2068163621616554370 · Twitter Post
• https://vulncheck.com/advisories/capgo-account-merge-via-poisoned-public-users-email-in-sso-provisioning · Note
• https://twitter.com/infoflowcloud/status/2068164713410609567 · Twitter Post