VulnSocial

CVE-2026-56215Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-20: 2Technical Details · 2026-06-20: 206-20
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-56215 Capgo before 12.128.12 allows authenticated users to modify their mutable http://public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an … https://www.cve.org/CVERecord?id=CVE-2026-56215 ----- Traducción: CVE-2026-5621… http://infoflow.cloud`

    Post summary

    The text reports on CVE-2026-56215, describing how authenticated users can alter email addresses that are trusted by an SSO provisioning endpoint. It provides a concise technical description but does not include a PoC, exploit code, active exploitation evidence, or patch info.

    0000080
    88 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-56215 Capgo before 12.128.12 allows authenticated users to modify their mutable http://public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an … https://www.cve.org/CVERecord?id=CVE-2026-56215

    Post summary

    The CVE shows that authenticated users in Capgo versions before 12.128.12 can change their public.users.email to arbitrary addresses, leading the SSO provisioning endpoint to trust those addresses. No PoC, exploit code, or patch is mentioned.

    00000288
    57.7K followersView on X

Explore more

Back to dashboard