PT-2026-57172 · Cap Go · Cap-Go

Judel777 · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56312

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Capgo before 12.128.2 contains an improper validation vulnerability in the accept invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-56312

Affected Products

Cap-Go

References · 3

• https://github.com/Cap-go/capgo/security/advisories/GHSA-whc5-fvr7-g5v3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56312 · Security Note
• https://vulncheck.com/advisories/capgo-account-creation-before-captcha-validation-in-accept-invitation-endpoint · Note