Vulnary
← back to the feed
Critical· 9.3

CVE-2026-88864

Capgo (capgo.app) does not properly restrict write access to the public.sso_providers table exposed through Supabase PostgREST. An attacker who possesses an ordinary Capgo full API key can insert a forged row with status='active' and enforce_sso=true, bypassing all intended SSO provisioning controls. This allows the attacker to assert SSO enforcement for any domain, disrupting normal login. All versions are affected and, at the time of the advisory, no patch was available.

publishedSep 10, 2026
last modifiedSep 10, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
18th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 25, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

All users of Capgo (capgo.app) using any version.

02

Real-world impact

Attackers can falsely claim that a domain has SSO enabled and enforced, leading to unauthorized access or denial of legitimate login attempts.

03

Why this severity

The vulnerability is rated critical (CVSS 9.3) because it can be exploited remotely without authentication or user interaction, resulting in a high impact on confidentiality, integrity, and availability of the authentication system.

04

What to do about it

no official fix yet

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
CVE-2026-88864: Capgo (capgo.app) does not properly restrict write access to the publi · Vulnary