CVE-2026-56308

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Insufficient verification during the email change process allows an attacker with access to a valid session cookie or an authenticated browser to change the account email address. This occurs because the system does not require re-authentication with the current password or verification of the existing email address. Consequently, an attacker can take control of account recovery and bypass multi-factor authentication protections.

Recommendations Update to version 12.128.2 or later.