CVE-2026-56312

MEDIUM 6.5

Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

CWE	CWE-287
Vendor	capgo
Product	capgo
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for capgo capgo

Be the first to know when new medium vulnerabilities affecting capgo capgo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

Capgo / Capgo

0 < 12.128.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cap-go/capgo/security/advisories/GHSA-whc5-fvr7-g5v3 vulncheck.com: https://www.vulncheck.com/advisories/capgo-account-creation-before-captcha-validation-in-accept-invitation-endpoint

Credits

🔍 Judel777