CVE-2026-56256CWE-602

Capgo - Two-Factor Authentication Bypass via Organization Management API

High · published June 24, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, bypassing the globally enforced 2FA requirement.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2026-06-24T11:53Z
EPSS history
Timeline
  • 24 JUN 11:53Z
    Capgo - Two-Factor Authentication Bypass via Organization Management API
    cvelistv5