Capgo CVE-2026-56081

The target Capgo instance must be running a version prior to 12.128.2 with self-service email/password registration enabled and the standard 2FA enrollment endpoint reachable from the internet - both are default in stock Capgo deployments and in Capgo Cloud. The attacker only needs to know or guess the victim's email address before the victim first registers; once the victim has already created and verified their own account, this specific pre-registration takeover path is closed (though related account-binding issues may still apply). No authentication, user interaction, or non-default configuration is required on the attacker side, consistent with the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H justifies the 9.3 critical rating: exploitation is fully remote, requires no privileges, no user interaction, and no special attack requirements, and yields high confidentiality and integrity impact on the victim's account. Real-world risk is meaningful because the attack is trivially automatable against any known or guessable target email (e.g., harvested from an organization's domain), and the 2FA-pinning step makes recovery materially harder than a standard account takeover. That said, no EPSS score was provided in the input, the CVE is not in CISA KEV, and no POC or in-the-wild exploitation has been reported - so prioritization should weigh ease of exploitation and identity-impact severity against the absence of confirmed active abuse and Capgo's relatively narrow user base (mobile-app developers and their orgs) compared to mass-market SaaS.

An attacker enumerates target email addresses from a victim organization's public domain, signs up to Capgo with one of those addresses, completes the registration flow without ever opening the verification email, and immediately enrolls TOTP-based 2FA on the squatted account. When the legitimate employee later tries to sign up or log in with their corporate email, they discover the account already exists, 2FA they never set up blocks any recovery attempt, and the attacker silently controls any organization-level policies, app update channels, or release artifacts associated with that identity. No public POC has been published, but the steps are simple HTTP calls against the standard signup and 2FA-enrollment endpoints and could be scripted in minutes.