CVE-2026-56256 Details

A vulnerability exists in Capgo versions prior to 12.128.2, where mandatory two-factor authentication (2FA) is enforced only at the user interface level. Sensitive Organization management API endpoints, such as those for editing organization details and inviting users, do not verify 2FA completion on the backend. This allows an authenticated Admin user who has not enabled 2FA to replay or modify a previously captured API request to perform privileged actions, bypassing the 2FA requirement.

To address this vulnerability, Capgo should enforce server-side 2FA checks for all sensitive Organization actions. It is recommended to validate 2FA completion on every privileged API request, invalidate previously issued tokens when 2FA becomes mandatory, implement centralized authorization middleware for Organization actions, and log and alert on attempts to access protected endpoints without 2FA.