CVE-2026-56256: Capgo 2FA Bypass in Organization Management API

Technical summary

The vulnerability stems from a separation of concerns failure in Capgo's authentication architecture. While the frontend UI enforces mandatory 2FA enrollment before allowing access to organization management features, the backend API endpoints handling sensitive operations (organization detail edits, user invitations, and similar privileged actions) lack corresponding 2FA validation logic. An authenticated principal with the PR (Privilege Required) level can bypass the UI-enforced 2FA check by directly invoking REST API endpoints, as the backend does not re-validate the 2FA requirement. This is classified as CWE-602 (Client-Side Enforcement of Server-Side Security).

Business impact

Organizations using Capgo are exposed to unauthorized administrative actions that could compromise organizational integrity and security posture. A compromised or malicious insider with admin credentials—but without 2FA enabled—can make unauthorized changes to organization settings, add unauthorized users to the organization, or modify critical configurations. This undermines access control governance and could facilitate lateral movement, privilege escalation, or data exfiltration by allowing an attacker to restructure the organization's access and authentication landscape without leaving an audit trail of a 2FA-verified action.

Affected systems

All Capgo installations running versions prior to 12.128.2 are affected. The vulnerability requires valid administrative credentials and network access to the API endpoints. Organizations that have mandated 2FA at the policy level—expecting the enforcement to apply uniformly—face a false sense of security.

Exploitability

Exploitation requires valid authenticated admin credentials; unauthenticated attackers cannot exploit this. However, the attack is straightforward and does not require user interaction once credentials are obtained. An attacker with admin access can immediately leverage this to perform sensitive organization actions. The CVSS score of 7.1 (HIGH) reflects the requirement for prior authentication, but acknowledges the ease of exploitation and high integrity impact once authenticated.

Remediation

Upgrade Capgo to version 12.128.2 or later immediately. This patch enforces 2FA validation at the backend API level, ensuring that all sensitive organization management endpoints verify 2FA completion regardless of how the request is initiated. After patching, verify that your admin user accounts have 2FA enabled and that audit logging captures all organization management API calls.

Patch guidance

Apply Capgo version 12.128.2 or later as soon as possible. Verify the patch by checking the running version in your Capgo instance (typically available in Settings or via the API version endpoint). After upgrading, conduct an audit of recent organization management API activity to identify any unauthorized changes made during the vulnerable window. Ensure all admin accounts have 2FA enabled before or immediately after the upgrade.

Detection guidance

Review audit logs for organization management API calls (e.g., API calls to edit organization details, invite users, or modify organization settings) made by admin accounts that had not enrolled in 2FA at the time of the request. Look for API requests originating from unexpected IP addresses or geographic locations. Monitor for sudden changes to organization members, roles, or settings that were not initiated through the expected UI workflows. Implement alerts on sensitive organization API endpoints to catch similar bypass attempts in the future.

Why prioritize this

This vulnerability is HIGH priority because it directly undermines a critical security control (2FA enforcement), allows authenticated insiders to perform high-impact actions without proper authentication, and affects organization governance. While it requires prior authentication, the ease of exploitation and the integrity impact on organizational configuration make it a pressing remediation target ahead of many other issues.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: (1) Network-based attack vector requiring no special network positioning, (2) Low attack complexity with no unusual conditions, (3) Low privilege requirement (admin account already compromised), (4) No user interaction needed, (5) Confidentiality impact (LOW—limited information disclosure), and (6) Integrity impact (HIGH—organization settings can be modified). The absence of availability impact keeps the score below 8.0. The real-world risk is elevated by the fact that 2FA enforcement is a foundational security control; bypassing it cascades trust in other safeguards.

Frequently asked questions