CVE-2026-56305

HIGH8.7

Capgo - Authentication Bypass in Password Change via Missing Current Password Validation

Published Jul 10, 2026

Modified 1 months ago

Details

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

References

ADVISORY

https://github.com/Cap-go/capgo/security/advisories/GHSA-rjr5-qxqj-cx8g

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-56305

ADVISORY

https://www.vulncheck.com/advisories/capgo-authentication-bypass-in-password-change-via-missing-current-password-validation

CVSS Analysis

CVSS v4.0

8.7

Exploitability

Attack Vector