CVE-2026-56286 Details
Description
Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.
An authentication bypass vulnerability has been identified in Capgo versions prior to 12.128.2, specifically in the account deletion endpoint. This vulnerability allows users to delete accounts without requiring password re-authentication or secondary verification. Exploitation can occur through session hijacking, Cross-Site Request Forgery (CSRF) attacks, or parameter tampering, leading to unauthorized account deletions, data loss, and denial-of-service conditions for users.
Users are advised to update to Capgo version 12.128.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-cjvr-jxp5-4p9x | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-cjvr-jxp5-4p9x | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/capgo-account-deletion-without-password-confirmation | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |