EUVD-2026-38743Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API reachable (AV:N), simple replay (AC:L), requires authenticated admin role so PR:L not PR:N, no UI, integrity high via org changes, confidentiality low, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, bypassing the globally enforced 2FA requirement.
AnalysisAI
Two-factor authentication bypass in Capgo before 12.128.2 allows an authenticated admin who has not completed 2FA enrollment to perform privileged organization management actions by replaying or modifying captured API requests. The flaw stems from 2FA being enforced exclusively in the frontend UI while the backend ORG management endpoints accept requests without verifying 2FA completion. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Capgo is a live-update and over-the-air deployment service for Capacitor-based mobile applications, where administrators manage organizations, members, and deployment configurations through a web dashboard backed by a REST/HTTP API. The root cause is CWE-602 (Client-Side Enforcement of Server-Side Security): the global 2FA requirement is implemented as a UI-layer gate that hides or disables sensitive controls, but the underlying organization endpoints (such as editing organization details and inviting users) trust the session/token alone and never re-check whether the authenticated principal has actually satisfied the second-factor challenge. The affected component is identified by CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:* for all versions prior to 12.128.2.
RemediationAI
Upgrade to Capgo 12.128.2 or later, which is the vendor-released patch that enforces 2FA validation server-side on organization management endpoints, per the GitHub advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-cww4-5xfp-jw98. Until the upgrade is deployed, administratively require every admin account to complete 2FA enrollment (so no admin session can exist without a satisfied factor), revoke or rotate API tokens/sessions issued to admins who have not enrolled, and audit recent calls to organization edit and member-invite endpoints for actions performed by non-2FA-enrolled admins; the trade-off is that forcing enrollment may temporarily lock out admins who lose their second factor and that token rotation breaks any automation relying on long-lived admin tokens. Restricting the organization management API to a known IP range via reverse-proxy or WAF rules is a further compensating control, at the cost of breaking legitimate remote admin access.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today