What is CVE-2026-53868?

CVE-2026-53868 is a high-severity vulnerability in Capgo, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-06-12.

How severe is CVE-2026-53868?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Capgo

CVE-2026-53868

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

Vulnerability class: Broken Authentication

EPSS: 0.003 (17.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Capgo — versions 0, 12.128.2

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-53868?: CVE-2026-53868 is a high-severity vulnerability in Capgo, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-06-12.
How severe is CVE-2026-53868?: High severity. CVSS v3 base score is 7.5 out of 10.