CVE-2026-88864
Capgo (capgo.app) does not properly restrict write access to the public.sso_providers table exposed through Supabase PostgREST. An attacker who possesses an ordinary Capgo full API key can insert a forged row with status='active' and enforce_sso=true, bypassing all intended SSO provisioning controls. This allows the attacker to assert SSO enforcement for any domain, disrupting normal login. All versions are affected and, at the time of the advisory, no patch was available.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
All users of Capgo (capgo.app) using any version.
Real-world impact
Attackers can falsely claim that a domain has SSO enabled and enforced, leading to unauthorized access or denial of legitimate login attempts.
Why this severity
The vulnerability is rated critical (CVSS 9.3) because it can be exploited remotely without authentication or user interaction, resulting in a high impact on confidentiality, integrity, and availability of the authentication system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources