CVE-2026-56305 | Capgo before 12.128.2 contains an authentication bypass vuln… | CVSS 8.3 HIGH

Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

Metadata

CVE ID: CVE-2026-56305
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-20 12:53 UTC
Published: 2026-07-10 13:57 UTC
Last updated: 2026-07-10 13:57 UTC
Primary CWE: CWE-620
Unverified Password Change
Vendor / Product: Capgo / Capgo
Sources: cve.org · NVD

Severity & Metrics

8.3 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected products (1)

Vendor	Product	Platform	Versions
Capgo	Capgo	—	0 < 12.128.2, 12.128.2

Weakness (CWE)

CWE	Source	Description
CWE-620	cna	Unverified Password Change

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
8.3	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References (2)

GitHub Security Advisory (GHSA-rjr5-qxqj-cx8g) https://github.com/Cap-go/capgo/security/advisories/GHSA-rjr5-qxqj-cx8g
VulnCheck Advisory: Capgo - Authentication Bypass in Password Change via Missing Current Password Validation https://www.vulncheck.com/advisories/capgo-authentication-bypass-in-password-change-via-missing-current-password-validation