CVE-2026-53868

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Cap-go/capgo/security/advisories/GHSA-3wfv-m8fq-7r5g
https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unverified-email-account-registration-and-deletion

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Capgo anterior a 12.128.2 contiene una vulnerabilidad de denegación de servicio que permite a los atacantes registrar cuentas utilizando direcciones de correo electrónico arbitrarias sin verificación, y luego iniciar la eliminación para bloquear los correos electrónicos en estado de eliminación pendiente. Los atacantes pueden bloquear permanentemente a usuarios legítimos fuera de la plataforma durante 30 días explotando la propiedad no verificada del correo electrónico en las operaciones del ciclo de vida de la cuenta.

12 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-12 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-53868

Mitre link : CVE-2026-53868

CVE.ORG link : CVE-2026-53868

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-53868", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53868", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:13:52.513925Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/Cap-go/capgo", "vendor": "Capgo", "product": "Capgo", "versions": [{"status": "affected", "version": "0", "lessThan": "12.128.2", "versionType": "semver"}, {"status": "unaffected", "version": "12.128.2", "versionType": "semver"}], "packageURL": "pkg:github/Cap-go/capgo", "defaultStatus": "unaffected"}]}], "published": "2026-06-12T22:16:56.153", "references": [{"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-3wfv-m8fq-7r5g", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unverified-email-account-registration-and-deletion", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations."}, {"lang": "es", "value": "Capgo anterior a 12.128.2 contiene una vulnerabilidad de denegaci\u00f3n de servicio que permite a los atacantes registrar cuentas utilizando direcciones de correo electr\u00f3nico arbitrarias sin verificaci\u00f3n, y luego iniciar la eliminaci\u00f3n para bloquear los correos electr\u00f3nicos en estado de eliminaci\u00f3n pendiente. Los atacantes pueden bloquear permanentemente a usuarios leg\u00edtimos fuera de la plataforma durante 30 d\u00edas explotando la propiedad no verificada del correo electr\u00f3nico en las operaciones del ciclo de vida de la cuenta."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "disclosure@vulncheck.com"}