Vulnerability Description
Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, bypassing the globally enforced 2FA requirement.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-cww4-5xfp-jw98
- https://www.vulncheck.com/advisories/capgo-two-factor-authentication-bypass-via-
- https://github.com/Cap-go/capgo/security/advisories/GHSA-cww4-5xfp-jw98
FAQ
What is CVE-2026-56256?
CVE-2026-56256 is a vulnerability with a CVSS score of 7.1 (HIGH). Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do n...
How severe is CVE-2026-56256?
CVE-2026-56256 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56256?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.