CVE-2026-56305

HighCVSS 8.3/10Last modified Jul 14, 2026

Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-620

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2026
Last modified
Jul 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-563066.4Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcemenCVE-2026-563074.3Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path thCVE-2026-563087.3Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing emaiCVE-2026-563095.4Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to creaCVE-2026-56317.3A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backendCVE-2026-563104.3Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API CVE-2026-563115.3Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unautheCVE-2026-563126.5Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captCVE-2026-563138.1Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise admiCVE-2026-563147.1Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to reCVE-2026-563159.8picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pCVE-2026-563165.3Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthent