Capgo CVE-2026-56305

Exploitation requires the attacker to already possess a valid low-privilege Capgo session (PR:L) for the target account - described as 'temporary session access' - after which the password-change endpoint accepts a new password without any current-password confirmation. The specific enabling condition is the missing current-password validation on that endpoint; the limiting factor is that the attacker cannot start from zero: they must first acquire a live session token (via theft, hijack, shared/kiosk access, or delegated login), and no separate user interaction from the victim is needed (UI:N). This is not remote-unauthenticated exploitation of a default install - a pre-existing session is the hard prerequisite that bounds realistic risk.

The CVSS 4.0 base score of 8.7 (High) is driven by AV:N/AC:L/AT:N with VC:H and VI:H, tempered by PR:L - exploitation is remote and low-complexity but requires an existing low-privilege session rather than being fully unauthenticated. This is the pivotal caveat: the vulnerability is a privilege/session-escalation amplifier, not a standalone remote takeover, so real-world risk depends on how attackers obtain that initial 'temporary session access' (stolen tokens, shared/kiosk sessions, XSS, or leaked session cookies). No EPSS score, KEV listing, or POC was supplied, so there is no evidence of widespread automated exploitation; the SSVC picture is therefore 'Proof-of-Concept absent, exploitation not observed.' Net assessment: a genuine and worth-patching issue because it turns a transient foothold into permanent account control, but not an internet-facing unauthenticated emergency - prioritize based on whether Capgo sessions are exposed to session-theft vectors.

An attacker obtains a temporary Capgo session - for example a session token left active on a shared workstation, captured via network/XSS, or a briefly delegated login - and issues a password-change request that succeeds without supplying the victim's current password. The attacker sets a new password, the legitimate user is locked out, and the attacker retains full control of the account and its associated OTA update capabilities. No public POC was provided, but the low attack complexity (AC:L) makes exploitation trivial once a session is held.