EUVD-2026-36629
GHSA-2cqf-7mh8-jphj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reachable over the network with no auth or interaction via the public signup/delete endpoints; only availability is impacted (account-namespace lockout), no confidentiality or integrity loss, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.
AnalysisAI
Denial of service in Capgo before 12.128.2 allows remote unauthenticated attackers to lock legitimate users out of the platform for 30 days by registering accounts with arbitrary unverified email addresses and immediately initiating account deletion, placing the targeted email in a pending-deletion lock state. The CVSS 4.0 score of 8.7 (High) reflects high availability impact achievable over the network without privileges or interaction; no public exploit identified at time of analysis, though the attack is trivially reproducible from the description.
Technical ContextAI
Capgo is a live-update / OTA service for Capacitor mobile applications, and the affected component is its account lifecycle subsystem. The root cause is CWE-306 (Missing Authentication for Critical Function): the registration endpoint accepts and binds an email address to a new account without first verifying that the requester controls that mailbox, and the deletion workflow then treats that unverified email as a real account identifier, applying a 30-day soft-delete lock. Because email ownership is never proven before destructive state transitions are allowed, an attacker can poison the account namespace of any email they can name.
RemediationAI
Vendor-released patch: upgrade Capgo to 12.128.2 or later, per the GitHub Security Advisory GHSA-3wfv-m8fq-7r5g (https://github.com/Cap-go/capgo/security/advisories/GHSA-3wfv-m8fq-7r5g). If immediate upgrade is not possible, compensating controls include requiring successful email verification (clicking a tokenized link) before the account is persisted or eligible for deletion - accepting the trade-off that signup completion is delayed until verification - and refusing to enter the 30-day pending-deletion lock for accounts whose email has never been verified, instead hard-deleting unverified accounts immediately so the email is freed for legitimate re-registration. Rate-limiting and CAPTCHA on the registration and account-deletion endpoints reduce mass abuse but do not close the underlying flaw and may add friction for legitimate users.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today