TI-2026-38938 Aliases CVE-2026-53981

Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism

HIGH 65CWE-306Published 2026-06-12 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00267 18th percentileScored 2026-11-07

Fix Fixed Cap-go (Cap-go): 12.128.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Capgo	Cap-go	before 12.128.2	12.128.2	Patch available	CNA

Cap-go VendorCapgo Affected before 12.128.2 Fixed in 12.128.2 Patch available CNA

Remediation

Fix · CNA Cap-go (Cap-go) Fixed in 12.128.2

Timeline

2026-10-02 Threatist record created from CVE-2026-53981

References

Patch 1

https://github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e

Advisory 1

GitHub Security Advisory (GHSA-w56g-jv78-hf79)

TI-2026-40602 Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation CVSS 4.0CRITICAL 9.3
TI-2026-40473 Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email CVSS 4.0CRITICAL 9.3
TI-2026-40465 Cap-go - OTP Bypass via Response Manipulation in Email Verification CVSS 4.0CRITICAL 9.3
TI-2026-64782 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles CVSS 4.0HIGH 8.7
TI-2026-40704 Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC CVSS 4.0HIGH 8.7
TI-2026-40689 Capgo - Rate Limit Bypass via User-Controlled device_id Parameter CVSS 4.0HIGH 8.8

See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences