CVE-2026-88864

Capgo (capgo.app), a live-update service for Capacitor mobile apps, fails to restrict direct write access to its public.sso_providers table exposed through Supabase PostgREST (CWE-284). Anyone holding an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend provisioning path and its controls, including the Enterprise plan requirement, creation via the Supabase Management API, DNS TXT domain-ownership verification, the pending_verification to verified to active status transition, and trusted provider ID issuance. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports has_sso=true and enforce_sso=true for domains that were never verified. This lets an attacker assert attacker-controlled SSO enforcement for arbitrary domains and disrupt normal login flows, and all Capgo versions are affected. No public proof-of-concept or in-the-wild exploitation is known, and no patch was available at the time of the advisory.

What to do: No fixed version is available yet, so monitor the vendor for a patch and apply it promptly when released. Until then, treat Capgo full API keys as sensitive, limit who holds them and rotate any keys that may have been shared or leaked, and audit the public.sso_providers table (via Supabase) for unexpected rows with status='active' and enforce_sso=true for domains you did not verify; self-hosted operators can mitigate by restricting PostgREST write access to that table.