CVE-2026-56212 Details

An authentication logic flaw has been identified in Capgo versions prior to 12.128.2. This flaw allows users with the ability to manage team or organization security settings to enforce mandatory two-factor authentication (2FA) for all team members without first enabling 2FA on their own accounts. The application does not verify the 2FA status of the user initiating the policy change, leading to inconsistent security enforcement, potential misuse of administrative privileges, and the risk of locking out team members.

Admins should be required to enable 2FA on their own accounts before they can enforce 2FA policies organization-wide. Additionally, the application should include backend validation to check an admin's 2FA status before allowing policy changes, enforce hierarchical security rules, and log and monitor security-policy changes.