CVE-2026-56305

Published: Jul 10, 2026Modified: Jul 14, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

Related CWEs

CWE-620

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References (3)

https://github.com/Cap-go/capgo/security/advisories/GHSA-rjr5-qxqj-cx8g

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/capgo-authentication-bypass-in-password-change-via-missing-current-password-validation

Source: disclosure@vulncheck.com

https://github.com/Cap-go/capgo/security/advisories/GHSA-rjr5-qxqj-cx8g

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.