CVE-2026-56308: Capgo - Insufficient Authentication in Email Change Endpoint

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-12 · updated 2026-10-25
Weakness: CWE-640

Description

Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with access to a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

Affected products

Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-9px4-w25f-mvm4
https://www.vulncheck.com/advisories/capgo-insufficient-authentication-in-email-change-endpoint
https://github.com/Cap-go/capgo/security/advisories/GHSA-9px4-w25f-mvm4

Get alerted when CVE-2026-56308 or the next vulnerability affects your stack