EUVD-2026-38098
GHSA-4f3c-ph4g-54q4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required to access security settings (PR:H); limited confidentiality and integrity impact reflects policy inconsistency rather than data exfiltration or system takeover; no availability impact to the system itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The application fails to verify the initiator's 2FA status before allowing the policy change, resulting in inconsistent security enforcement, potential administrative misuse, and lockout risk for team members.
AnalysisAI
Authentication logic bypass in Capgo before 12.128.2 permits a team or organization security settings manager to enforce mandatory two-factor authentication across all team members without having 2FA active on their own account. The platform never validates the initiator's own 2FA enrollment state before committing the policy change, creating an asymmetric enforcement condition where the policy creator is effectively exempt from the mandate they impose. No public exploit code has been identified and Capgo is not listed in the CISA Known Exploited Vulnerabilities catalog; the CVSS 4.0 score of 5.1 (PR:H) reflects that exploitation is constrained to already-privileged insiders.
Technical ContextAI
Capgo is a mobile application live-update and over-the-air deployment platform (CPE: cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*). The root cause is classified as CWE-269 (Improper Privilege Management): the security-settings API endpoint that activates a team-wide 2FA mandate fails to include a pre-flight authorization check that would verify the calling user's own 2FA enrollment status. This is a server-side business-logic flaw - a missing prerequisite gate in the privilege escalation path for security policy changes - rather than a memory-safety or injection-class vulnerability. The flaw means the platform's own security controls can be weaponized asymmetrically by a user who holds the 'manage security settings' permission but has not personally adopted the control they are enforcing on others.
RemediationAI
Vendor-released patch: Capgo 12.128.2. Organizations should upgrade to 12.128.2 or later as the primary remediation; the fix is expected to introduce a server-side check that blocks the 2FA mandate policy change unless the initiating user already has 2FA enrolled on their own account. The full advisory is at https://github.com/Cap-go/capgo/security/advisories/GHSA-w2cr-vcwj-69x2. As a compensating control prior to patching, platform administrators should restrict the 'manage team/organization security settings' permission exclusively to accounts that already have 2FA enabled, reducing the population of users who can trigger the flawed code path. Note that restricting this permission may temporarily impede legitimate security administration workflows until the patch is applied.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today