CVE-2026-56286

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56286

EUVD

EUVD-2026-40434

Affected Vendors & Products

Vendor	Product	Version / Range
capgo	capgo	to 12.128.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves an authentication bypass in the account deletion endpoint.

It allows attackers to delete user accounts without requiring password re-authentication or secondary verification.

Attackers can exploit this vulnerability through session hijacking, Cross-Site Request Forgery (CSRF) attacks, or parameter tampering.

As a result, unauthorized account deletion can occur, leading to data loss and denial-of-service conditions.

Impact Analysis

This vulnerability can have serious impacts including unauthorized deletion of user accounts.

Such unauthorized deletions can cause loss of important user data.

Additionally, it can lead to denial-of-service by disrupting normal account operations.

Hi! I’m here to help you understand CVE-2026-56286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70