CVE-2026-56312CWE-287

Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

Medium · published July 10, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-10T13:57Z
EPSS history
Timeline
  • 10 JUL 13:57Z
    Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
    cvelistv5