CVE-2026-56312: Capgo Account Invitation Captcha Bypass (CVSS 6.5)

Technical summary

CVE-2026-56312 involves improper input validation in Capgo's accept_invitation endpoint. The vulnerable code path performs user account creation before enforcing captcha validation checks, violating the principle of defense-in-depth. An unauthenticated attacker can send a POST request with an intentionally invalid captcha token (or omit the token entirely) and the endpoint will process the account creation regardless. This reflects a CWE-287 (Improper Authentication) design flaw where a security control is evaluated after rather than before the protected action. The vulnerability requires no user interaction, no authentication, and is trivial to exploit remotely.

Business impact

This vulnerability degrades the security of Capgo's user acquisition and account management processes. Attackers can exhaust or invalidate legitimate invitation links by creating dummy accounts, disrupting onboarding workflows. If invitations are tied to specific users or organizations, attackers may also perform account enumeration or occupy reserved slots. The low barrier to entry (a single HTTP request) means the attack can be automated at scale, potentially affecting user trust and platform availability during sign-up phases.

Affected systems

Capgo versions before 12.128.2 are affected. The vulnerability exists in the account invitation acceptance endpoint and impacts any deployment using the default configuration. Users of Capgo 12.128.2 and later are not affected.

Exploitability

Exploitability is high in practical terms. The attack requires only network access and no special privileges or user interaction. An attacker can craft a simple POST request to the accept_invitation endpoint with any invalid captcha token and observe successful account creation. Automated exploitation is straightforward, allowing bulk account registration. There is no known public exploit code, but the vulnerability is trivially reproducible.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch enforces captcha validation before account creation, ensuring the security control is evaluated first. Organizations unable to patch immediately should implement network-level controls to rate-limit or restrict access to the accept_invitation endpoint.

Patch guidance

Apply Capgo 12.128.2 or later as soon as practical. Verify the upgrade through your package manager or release notes. If running Capgo in a containerized environment, ensure your image is rebuilt with the patched version. Test the account invitation flow in a staging environment to confirm captcha validation is now enforced before account creation.

Detection guidance

Monitor for suspicious patterns in account creation logs, specifically multiple new accounts created in rapid succession from the same IP or with minimal time between requests. Log and alert on accept_invitation endpoint calls that reference invalid or missing captcha tokens. If you have detailed request logging, look for POST requests to /invite/accept or similar endpoints with malformed or absent captcha parameters that resulted in HTTP 200 responses. Correlation with a spike in account creation can confirm exploitation.

Why prioritize this

Although the CVSS score is 6.5 (Medium), this vulnerability warrants timely patching because it undermines a fundamental authentication boundary and is trivially exploitable. The attack surface is broad—any public-facing Capgo instance—and the attack vector requires zero sophistication. Organizations heavily reliant on their invitation system for user onboarding should prioritize this patch to prevent disruption and account enumeration.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects network accessibility (AV:N), low complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U). The impact is limited to integrity (account creation) and availability (invitation link consumption), with no confidentiality breach, resulting in a Medium severity rating. However, the simplicity of exploitation and the foundational nature of the flaw justify close monitoring and near-term remediation.

Frequently asked questions