CVE-2026-100612

Executive Summary

CVE-2026-100612 is an incomplete access-control fix in Capgo (capgo.app) through version 12.261.0 affecting the public.sso_providers table. An attacker who already holds the org_admin tier permission org.update_settings can PATCH the provider_id column via PostgREST, repointing an organization's SSO trust anchor to an identity provider they control, and then authenticate as the org owner — taking over the account, nulling its password, and locking out the legitimate owner. The vulnerability has a CVSS 3.1 base score of 7.2 (High) and requires an active SSO provider plus prior org_admin access in the target organization.

Technical Analysis

Capgo's SSO trust model binds an email domain to an authorized identity provider (IdP) through the provider_id column of public.sso_providers. That column functions as the trust anchor: when a user authenticates through SSO, the backend matches the asserted email domain against a row in sso_providers and uses provider_id to decide which IdP is authoritative. Once matched, the merge routine attaches the incoming SSO identity to the existing account for that email.

A prior fix was shipped as migration 20260826100000_sso_providers_block_direct_active_insert.sql. It installs a BEFORE UPDATE trigger function, enforce_sso_provider_client_update_guard(), intended to prevent clients from directly mutating security-relevant columns. The guard freezes only four columns — dns_verified_at, domain, status, and enforce_sso — leaving provider_id, metadata_url, and attribute_mapping writable.

The root cause is a column-level authorization failure (CWE-639, Authorization Bypass Through User-Controlled Key). The table is granted ALL to the anon and authenticated roles with no column-level restriction. PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated, not which columns. Because provider_id remains writable and is the value the server uses to select the IdP, an org_admin can overwrite the trust anchor via a PostgREST PATCH request. The update is not blocked by the trigger (column not in the frozen set), not blocked by RLS (the row belongs to the organization the attacker administers), and not blocked by grants (table-level ALL applies to every column).

The result is a logic flaw in the authorization model: an entity authorized to change "settings" gains the effective ability to re-point the IdP of record, which the application treats as equivalent to ownership of the email domain.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class described in the advisory and the documented mechanisms. No function names, endpoints, or parameters beyond those in the description are assumed.

1. Precondition and reconnaissance. The attacker must already hold org_admin in the target organization with the org.update_settings tier permission, and the organization must have an active SSO provider configured. The attacker enumerates the organization's sso_providers rows (readable given the broad grants) to identify the provider_id currently bound to the owner's email domain and to confirm the provider is active.

2. Triggering the flaw. The attacker issues a PostgREST PATCH against the public.sso_providers row, modifying provider_id to reference an IdP under the attacker's control. The BEFORE UPDATE guard enforce_sso_provider_client_update_guard() does not fire on provider_id (it only blocks changes to dns_verified_at, domain, status, and enforce_sso), and the allow_org_admins_update_sso_providers RLS policy permits the row update because the attacker is an org_admin of that organization. No column-level privilege stands in the way because ALL is granted on the table.

3. Execution / authentication. The attacker authenticates through their own IdP while asserting the organization owner's email address. The server-side provider match now resolves against the attacker-controlled provider_id; because that is the trusted IdP by the server's logic, the match succeeds.

4. Post-exploitation impact. The SSO merge routine attaches the attacker's SSO identity to the existing owner account, nulls the account's password, and deletes the owner's other identities and sessions. The attacker thus escalates vertically from org_admin to org owner / super_admin, achieves full account takeover, and locks out the legitimate owner. Because the owner's password is nulled and alternate identities removed, recovery requires out-of-band intervention by the platform operator.

Optional adjacent abuse: metadata_url and attribute_mapping are also writable, which may allow the attacker to further shape how the IdP response is interpreted, though the primary path is via provider_id.

Impact Assessment

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — 7.2 High.

• AV:N — exploitation is network-reachable through the PostgREST interface.
• AC:L — the attack requires no race or unusual conditions; the update and SSO authentication follow deterministic paths.
• PR:H — the attacker must already possess org_admin with org.update_settings, hence "High" privileges required rather than "None".
• UI:N — no victim interaction is needed; the owner need not click anything.
• S:U — the impact stays within the Capgo authorization scope.
• C/I/A:H — confidentiality, integrity, and availability are all High: the attacker reads and acts as the org owner (C), alters the account binding and destroys the owner's identities/sessions (I), and locks the legitimate owner out (A).

Blast radius is any Capgo organization with an active SSO provider in which an org_admin exists. Because the escalation reaches the owner/super_admin tier, the attacker can potentially pivot to organization-wide settings, other SSO-bound accounts, and any data the owner can reach. The lockout component (nulled password, deleted identities and sessions) raises recovery cost and can create a sustained denial of access to the legitimate owner.

Detection Guidance

Sigma Rule

title: Capgo sso_providers provider_id Tampering (CVE-2026-100612)
id: 8f0a4c21-5b6e-4f1d-9c2a-cve2026100612
status: experimental
description: Detects PATCH updates to the Capgo sso_providers table that modify provider_id, the SSO trust anchor abused in CVE-2026-100612.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100612
author: valtersit.com
date: 2026/01/01
logsource:
  product: capgo
  category: application
detection:
  selection_method:
    http.method: PATCH
  selection_path:
    url.path|contains: '/sso_providers'
  selection_body:
    - 'provider_id'
  condition: selection_method and selection_path and selection_body
fields:
  - client.ip
  - user.name
  - http.method
  - url.path
  - request.body
level: high
falsepositives:
  - Legitimate SSO provider reconfiguration by platform operators
  - Administrative maintenance via service accounts
tags:
  - attack.t1078
  - cve.2026.100612

YARA Rule

rule CVE_2026_100612_Capgo_SSO_ProviderID_Tamper
{
    meta:
        description = "Detects Capgo PATCH payloads and migration/guard artifacts associated with CVE-2026-100612"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100612"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "sso_providers" ascii nocase
        $b = "provider_id" ascii nocase
        $c = "org.update_settings" ascii nocase
        $d = "metadata_url" ascii nocase
        $e = "attribute_mapping" ascii nocase
        $f = "enforce_sso_provider_client_update_guard" ascii
        $g = "allow_org_admins_update_sso_providers" ascii
        $patch = "PATCH" ascii

    condition:
        uint32(0) != 0x89504E47 and filesize < 2MB and
        (($a and $b and $patch) or ($f and $b) or ($g and $b))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100612 Capgo SSO provider_id Tampering via PostgREST"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"sso_providers"; nocase; http.request_body; content:"provider_id"; nocase; reference:cve,2026-100612; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100612; classtype:attempted-admin; sid:2026100612; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, client.ip with maxspan=5m
  [ http where http.request.method == "PATCH"
      and http.request.uri : "*sso_providers*"
      and http.request.body.text : "*provider_id*" ]
  [ authentication where event.action : "sso_login_success" ]

Splunk SPL Query

index=web OR index=postgrest sourcetype=access_combined OR sourcetype=capgo:audit
(http_method=PATCH url="*sso_providers*")
| rex field=request_body max_match=0 "(?<pendpoint>provider_id[^,]*)"
| where isnotnull(pendpoint)
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(src_ip) as src_ips by user
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="capgo,cve-2026-100612,">
  <rule id="1006121" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">PATCH</field>
    <field name="url.path">sso_providers</field>
    <field name="request.body">provider_id</field>
    <description>CVE-2026-100612: Capgo sso_providers provider_id modification detected - possible SSO trust anchor tampering</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>access_control_abuse,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict the org_admin tier: remove or tightly scope the org.update_settings permission so that only platform-trusted operators can hold it in organizations with active SSO.
• Apply column-level grants: REVOKE table-wide ALL from anon/authenticated and grant only the minimum columns required, explicitly excluding provider_id, metadata_url, and attribute_mapping.
• Extend the existing enforce_sso_provider_client_update_guard() trigger so the frozen column set includes provider_id, metadata_url, and attribute_mapping (do not rely on RLS for column authorization).
• Require out-of-band approval (dual control / ticket) for any change to sso_providers in production, and alert on every provider_id mutation (see detection rules).
• Monitor for the post-exploitation signature: sudden sso_login_success following a sso_providers PATCH, password nulled on an owner account, and mass deletion of identities/sessions. Preserve and rotate affected credentials out-of-band.

2) Patch / upgrade steps No vendor patch is currently available. Monitor Capgo release notes for a version beyond 12.261.0 that closes the column-level authorization gap; the fix must (a) freeze provider_id in the guard function, or (b) move authorization to column-level grants/RLS, and (c) ideally require explicit trust re-verification when the IdP binding changes. Until then, treat the product as UNPATCHED and rely on the compensating controls above.

3) Long-term hardening

• Enforce least privilege at the column level for all security-relevant tables, not just row level; audit every table granted ALL to anon/authenticated.
• Adopt an allowlist-based update path for SSO provider records with an approval workflow and immutable audit logging.
• Re-verify domain ownership / DNS proof whenever provider_id changes, and never treat a mutable row value as an unauthenticated trust anchor.
• Add regression tests (unit and integration) that attempt column-level writes to provider_id from org_admin and fail the build if they succeed.
• Implement alerting that joins SSO config mutations to subsequent authentication events and account-ownership changes.

References

• NVD — CVE-2026-100612: https://nvd.nist.gov/vuln/detail/CVE-2026-100612
• CWE-639 Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Capgo product site: https://capgo.app
• No CISA KEV entry exists for this CVE; no public exploit code, Nuclei template, or PoC is currently available. No known threat-actor campaigns or in-the-wild exploitation have been reported.