Executive brief
Cap-go, a platform for managing app updates and backend functions, contains a security flaw in how it handles user email updates. If an attacker gains temporary access to a logged-in user's session (for example, on a shared computer), they can change the account's email address to one they control without needing to provide the current password or multi-factor authentication. This allows the attacker to permanently lock the original owner out and take full control of the account by performing a password reset.
Technical details
A Missing Authentication for Critical Function (CWE-306) vulnerability exists in Cap-go's email change workflow. The application fails to require re-authentication (password or MFA) or send a confirmation notice to the existing email address when a change is requested. An attacker with access to an active authenticated session can update the account email to an attacker-controlled address, verify the new email via a link sent only to that new address, and then use the password reset functionality to achieve full account takeover. This issue is resolved in version 12.128.2.
Affected products
- Cap-go Cap-go < 12.128.2
Timeline
- 2026-02-10: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Fix released in version 12.128.2