CVE-2026-53868: Capgo Account Lockout Vulnerability – Email Verification Bypass

Technical summary

The vulnerability stems from insufficient verification controls in Capgo's account lifecycle management. Specifically, the platform allows account registration with arbitrary email addresses without requiring verification of ownership before the account becomes active or before certain operations can be performed. An attacker can chain this with the account deletion workflow: by registering an account under a target's email and then initiating deletion, the email becomes locked in a pending deletion state. This design flaw violates the principle of verifying email ownership before permitting account-impacting actions. The issue is classified under CWE-306 (Missing Authentication for Critical Function), indicating that critical account operations lack proper identity verification controls.

Business impact

For organizations and users relying on Capgo, this vulnerability creates a straightforward denial of service vector requiring minimal effort or skill. Attackers can systematically target users by locking them out of accounts for 30-day periods, disrupting workflow and potentially affecting business operations dependent on continuous platform access. The attack requires no authentication or special privileges, making it accessible to any anonymous attacker. The reputational and operational impact includes user frustration, support ticket burden, and potential loss of confidence in the platform's account security posture. For SaaS platforms, account lockout attacks undermine user trust and service availability guarantees.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. The vendor has not provided a comprehensive list of specific products or components affected; patching to version 12.128.2 or later mitigates the vulnerability. Organizations running Capgo should verify their installed version against this threshold.

Exploitability

Exploitability is very high. The attack requires no special network positioning (network-accessible), no complex configuration (low complexity), no authentication credentials, and no user interaction. An attacker needs only the ability to reach Capgo's registration endpoint and initiate account operations. Automated tooling could easily scale this attack across many target email addresses simultaneously, making it a practical threat for any publicly accessible Capgo instance.

Remediation

Upgrade Capgo to version 12.128.2 or later. This version addresses the email verification gaps in account registration and deletion workflows. Organizations should prioritize this upgrade given the high exploitability and immediate impact on user accessibility. No workarounds are available short of patching.

Patch guidance

Verify your current Capgo version against the vendor advisory. If running a version prior to 12.128.2, update to 12.128.2 or the latest available release. Apply the patch in a test environment first to confirm compatibility with your deployment. Once validated, schedule the upgrade across your production Capgo instances with minimal user-facing downtime if applicable. Consult Capgo's official release notes for any compatibility notes or migration steps.

Detection guidance

Monitor Capgo logs for suspicious patterns: multiple account registrations from the same source IP or network, particularly those targeting common organizational email domains; rapid account deletions initiated immediately after registration; and failed login attempts against legitimate user accounts with pending email deletion states. Alert on spike activity in the account registration and deletion APIs. Consider implementing rate limiting on registration endpoints to slow down bulk account creation attempts. Review user reports of account lockout incidents and correlate them with account deletion activities.

Why prioritize this

Assign this vulnerability high priority due to the combination of high CVSS score (7.5), zero authentication requirements, and immediate impact on user availability. The 30-day lockout window compounds the harm, making it a significant operational threat. While not yet in CISA's KEV catalog, the straightforward exploit path and potential for automated abuse make rapid patching critical for any organization running vulnerable versions.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with low attack complexity, no privileges required, and high availability impact. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) captures that while confidentiality and integrity are unaffected, the availability impact is severe—legitimate users cannot access their accounts. The absence of user interaction and authentication requirements pushes the score into the high range despite the lack of data breach or integrity compromise.

Frequently asked questions