Incomplete Access Control in SSO Provider Configuration

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_mapping) is left writable. Because the table is granted ALL to the anon and authenticated roles with no column-level restriction, and PostgreSQL row-level security policies such as allow_org_admins_update_sso_providers constrain only which row may be updated and not which columns, a user holding the org_admin tier permission org.update_settings can PATCH provider_id over PostgREST to an identity provider under their control. Since provider_id is the trust anchor binding an email domain to an authorized IdP, the attacker can then authenticate through their own IdP while asserting the org owner's e

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Capgo's authentication platform contains a critical access control vulnerability in its public.sso_providers table where a migration intended to restrict direct updates failed to adequately protect sensitive columns. While the fix attempted to freeze dns_verified_at, domain, status, and enforce_sso columns, it left provider_id, metadata_url, and attribute_mapping writable to both anonymous and authenticated users. This allows attackers to modify SSO provider configurations without proper authorization, potentially enabling account takeover, privilege escalation, or lateral movement within environments relying on Capgo for single sign-on. Organizations using Capgo versions through 12.261.0 face immediate risk, particularly those storing sensitive identity and authentication metadata through this platform.

Capsy's 283 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques underlying this vulnerability. Practitioners using Casky would observe findings highlighting suspicious modifications to SSO metadata—specifically unauthorized updates to provider_id or attribute_mapping fields that deviate from expected configuration baselines. The platform's skills would flag anomalous database activity patterns, such as direct table writes bypassing application logic, coupled with timeline correlation showing these modifications preceding authentication anomalies or session hijacking events. Additionally, Casky would surface CWE-639 (Authorization Bypass Through User-Controlled Key) detection signals, alerting teams to instances where identity federation configurations were altered outside normal administrative workflows, enabling the advanced persistent access that makes SSO compromises particularly dangerous.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100612.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-100612

Casky has 283 skills that investigate the attack patterns behind CVE-2026-100612. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn