The vulnerability in Capgo's SSO prelink endpoint permits authorized enterprise administrators to remove password-based authentication for users outside their own organization if they have org.update_settings permission and an active SSO provider configured. By calling the prelink-users endpoint, attackers can delete password identities of users whose email domains match the attacker's SSO provider domain, effectively disrupting cross-organization account access and forcing victims to rely on the attacker's SSO or password reset mechanisms. This issue is present in Capgo versions prior to 12.128.2.

Attackers with specific administrative permissions can cause denial of password-based access for users in foreign organizations, potentially disrupting user authentication and forcing reliance on the attacker's SSO provider or password reset. This can lead to account disruption and potential loss of control over user authentication methods across organizational boundaries.

A fix is available in Capgo version 12.128.2 and later. Users should upgrade to version 12.128.2 or newer to remediate this vulnerability. No other mitigation guidance is provided.