CVE-2026-56308 Details

A vulnerability in Capgo versions prior to 12.128.2 allows users to change their email addresses without re-entering their current passwords or verifying their existing email. This flaw enables an attacker with access to a valid session cookie or authenticated browser to take control of the account's recovery process and bypass multi-factor authentication. The issue arises because the email change feature relies solely on the authenticated session as proof of identity, creating a risk of unauthorized account modifications.

Users are advised to update to Capgo version 12.128.2 or later, where this vulnerability has been patched.