CVE-2026-53868
HIGH EPSS 17.0%
Published Jun 12, 20262w ago · Modified Jun 17, 20262w ago
8.7 CVSS 4.0
Published Jun 12, 2026 2w ago
Last Modified Jun 17, 2026 2w ago
Description
Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
17.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-306 Missing Authentication for Critical Function Authentication
References 2
- github.com https://github.com/Cap-go/capgo/security/advisories/GHSA-3wfv-m8fq-7r5g
- vulncheck.com https://www.vulncheck.com/advisories/capgo-denial-of-service-via-unverified-email-account-registration-and-deletion
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.