The vulnerability in Capgo (capgo.app) involves an incomplete access-control fix on the public.sso_providers table. While a BEFORE UPDATE guard restricts changes to certain columns (dns_verified_at, domain, status, enforce_sso), the provider_id column remains writable. Because the table grants ALL privileges to anon and authenticated roles without column-level restrictions, and PostgreSQL row-level security policies only restrict which rows can be updated but not which columns, an attacker with org_admin permission (org.update_settings) can PATCH the provider_id to an attacker-controlled identity provider via PostgREST. Since provider_id is the trust anchor linking an email domain to an authorized IdP, this allows the attacker to authenticate as the org owner through their own IdP. The server-side provider match succeeds, merging the attacker's SSO identity with the owner account, nullifying the password, and deleting other identities and sessions. This results in vertical privilege escalation, account takeover, and lockout of the legitimate owner. Exploitation requires the target organization to have an active SSO provider and the attacker to already hold org_admin privileges. No patched version is available.

An attacker with org_admin privileges can escalate to org owner or super_admin by modifying the provider_id in the SSO providers table to an attacker-controlled identity provider. This leads to account takeover of the organization owner, nullification of the owner's password, deletion of other identities and sessions, and lockout of the legitimate owner. This is a high-severity vertical privilege escalation and account compromise vulnerability.

No patch or official fix is currently available for this vulnerability. Organizations should be aware that exploitation requires existing org_admin privileges and an active SSO provider configuration. Until a fix is released, restricting org_admin permissions to trusted users and monitoring for suspicious changes to SSO provider configurations may help reduce risk.