Improper Validation in Capgo Before 12.128.2

Executive Summary

CVE-2026-56312 is a vulnerability in Capgo versions before 12.128.2 where the accept_invitation endpoint improperly validates captcha tokens.

Specifically, the system creates user accounts before enforcing captcha validation, allowing attackers to bypass captcha protection by sending POST requests with invalid captcha tokens.

This results in unauthorized creation of unwanted user accounts and depletion of invite links.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the creation of unwanted user accounts without proper captcha verification.

Attackers can exploit this to burn invite links, potentially exhausting the system's invitation capacity.

It may also cause side effects related to unauthorized account creation even if subsequent authentication fails.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual POST requests to the accept_invitation endpoint that include invalid or malformed CAPTCHA tokens. Such requests may indicate attempts to create user accounts without proper CAPTCHA validation.

Network or application logs should be inspected for repeated POST requests to the accept_invitation endpoint with invalid CAPTCHA tokens or unexpected account creation activity.

Suggested commands to detect this activity might include using tools like curl or wget to simulate requests, or using log analysis commands such as:

• grep 'POST /accept_invitation' /var/log/nginx/access.log | grep 'invalid_captcha_token'
• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'accept_invitation'
• Use application-specific logging or monitoring tools to track account creation events and correlate them with CAPTCHA validation results.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include ensuring that CAPTCHA validation is enforced before any user account creation occurs in the accept_invitation endpoint.

Specifically, modify the application logic to validate the CAPTCHA token before calling the user creation function (e.g., supabaseAdmin.auth.admin.createUser()).

If the CAPTCHA validation fails, the user account creation should be blocked or rolled back to prevent unauthorized accounts and depletion of invite links.

Additionally, monitor and limit the rate of POST requests to the accept_invitation endpoint to reduce abuse.

Apply any available patches or updates from Capgo that address this vulnerability by upgrading to version 12.128.2 or later.

Useful 0 Not Useful 0