Vulnerability in Cap-Go Capgo.app
CVE-2026-88864
Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route (supabase/functions/_backend/private/sso/providers.ts) and its controls: the Enterprise plan requirement, SSO provider creation via the Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports {"has_sso": true, "enforce_sso": true} for domains that were never verified, allowing attacker-controlled SSO enforcement to be asserted for arbitrary domains and disrupting normal login. All versions are affected; at the time of the advisory no patch was available.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.004 (30.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/Cap-go/capgo.app/security/advisories/GHSA-xg7v-83qv-qfff (vendor-advisory)
- www.vulncheck.com/advisories/capgo-sso-provider-authentication-bypass-via-postg… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-88864?
- CVE-2026-88864 is a critical-severity vulnerability in Cap-Go Capgo.app, classified under Improper Access Control. CVSS score: 9.1/10. Published 2026-09-10.
- How severe is CVE-2026-88864?
- Critical severity. CVSS v3 base score is 9.1 out of 10.