Privilege escalation in Capgo
CVE-2026-56212
Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The application fails to verify the initiator's 2FA status before allowing the policy change, resulting in inconsistent security enforcement, potential administrative misuse, and lockout risk for team members.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Capgo — versions 0, 12.128.2
Weakness classification (CWE)
References
- github.com/Cap-go/capgo/security/advisories/GHSA-w2cr-vcwj-69x2 (vendor-advisory)
- www.vulncheck.com/advisories/capgo-improper-2fa-enforcement-logic-via-team-secu… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-56212?
- CVE-2026-56212 is a low-severity vulnerability in Capgo, classified under Improper Privilege Management. CVSS score: 3.8/10. Published 2026-06-20.
- How severe is CVE-2026-56212?
- Low severity. CVSS v3 base score is 3.8 out of 10.