PT-2026-51042 · Cap Go · Cap-Go

Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56212

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An authentication logic flaw exists where a user authorized to manage team or organization security settings can enforce mandatory two-factor authentication (2FA) for all team members without having 2FA enabled on their own account. The application does not verify the 2FA status of the initiator before permitting the policy change, which can lead to inconsistent security enforcement, administrative misuse, and the risk of locking out team members.

Recommendations Update to version 12.128.2.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-56212

Affected Products

Cap-Go

References · 5

• https://github.com/Cap-go/capgo/security/advisories/GHSA-w2cr-vcwj-69x2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56212 · Security Note
• https://vulncheck.com/advisories/capgo-improper-2fa-enforcement-logic-via-team-security-settings · Note
• https://twitter.com/infoflowcloud/status/2068164715226776036 · Twitter Post
• https://twitter.com/CVEnew/status/2068163625945096491 · Twitter Post