Capgo CVE-2026-56312

The accept_invitation endpoint must be reachable over the network, which is standard for any deployed Capgo instance. No authentication is required. The attacker must possess or be able to obtain a valid invite token - either by receiving a legitimate invitation, discovering a token through other means, or targeting a system with guessable token formats. Exploitation is limited to the invitation workflow: attackers cannot access existing user data, modify application configurations, or escalate within the platform. Capgo instances that do not use the invitation system or have no pending invite links are not meaningfully impacted. User interaction is not required on the victim's part.

The CVSS 4.0 score of 6.9 accurately characterizes a medium-severity, remotely exploitable flaw with no authentication barrier and low attack complexity, but with impact constrained to low integrity and low availability (VI:L/VA:L) - no confidentiality exposure exists. There is no EPSS data provided in the available intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis. The attack is trivially automatable given PR:N/AC:L/UI:N, which raises SSVC automatable signal, but the blast radius is bounded entirely to the invitation workflow. This is a genuine nuisance-to-moderate risk rather than a critical incident: an attacker can burn an organization's invite quota and create ghost accounts, but cannot read existing user data, execute code, or escalate privileges. The real-world priority should be calibrated to whether the affected Capgo deployment actively uses the invitation workflow.

An attacker discovers or is forwarded a valid Capgo invite link for a target organization. They script automated POST requests to the accept_invitation endpoint using the invite token but with arbitrary invalid captcha values. Because the account creation logic runs before captcha enforcement, each request results in a new account being committed and the invite link consumed, exhausting the organization's pending invitations and blocking legitimate users from onboarding.