CVE-2026-56215 – Capgo – Account Merge via Poisoned public.users.email in SSO Provisioning

CVE ID :CVE-2026-56215

Published : June 20, 2026, 12:14 a.m. | 1 hour, 28 minutes ago

Description :Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim’s corporate SSO email, causing the provision-user endpoint to merge the victim’s SSO identity into the attacker-controlled account.

Severity: 8.7 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…