CVE-2026-56081

Name of the Vulnerable Software and Affected Versions Cap-go versions prior to 12.128.2

Description An authentication logic flaw allows an attacker to register and control an account linked to a victim's email address before the email is verified. By enabling two-factor authentication on this pre-registered account, the attacker can seize control of the account claimed under the victim's identity. This enables the attacker to read and modify the account state and enforce organization-level policies, while the legitimate user is prevented from accessing the account associated with their own email.

Recommendations Update to version 12.128.2 or later.