PT-2026-49045 · Cap Go · Cap-Go

Naitik Gupta · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53868

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-53868

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-3wfv-m8fq-7r5g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53868 · Security Note
• https://vulncheck.com/advisories/capgo-denial-of-service-via-unverified-email-account-registration-and-deletion · Note