Is CVE-2026-56081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56081 being exploited in the wild.

How severe is CVE-2026-56081?

Critical severity, with a CVSS score of 9.1, published 19 June 2026.

Is there a fix for CVE-2026-56081?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56081 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56081?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56081: Cap-go authentication bypass and account lockout via 2FA misconfiguration

CVE-2026-56081 · Severity: critical · CVSS 9.1 · Published 2026-06-19

Cap-go, a platform for managing app updates, suffered from a flaw where attackers could register accounts using other people's email addresses without verification. By enabling two-factor authentication on these unverified accounts, an attacker could permanently lock the rightful owner out of the service and gain control over their identity on the platform. This allows unauthorized access to organizational data and prevents legitimate users from ever registering or accessing their own accounts.

Quick answers

Is CVE-2026-56081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56081 being exploited in the wild.
How severe is CVE-2026-56081?: Critical severity, with a CVSS score of 9.1, published 19 June 2026.
Which products and versions are affected?: Cap-go capgo < 12.128.2.
Is there a fix for CVE-2026-56081?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56081 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56081?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication logic flaw in Cap-go versions prior to 12.128.2 allowed for 'pre-account takeover' because the platform did not enforce email verification before granting dashboard access. An attacker could register an account using a victim's email address and immediately enable two-factor authentication (2FA) and organization-level 2FA policies. Because the attacker controls the 2FA device, the legitimate owner of the email address is unable to reclaim the account through password resets, resulting in a permanent denial of service and unauthorized control over the identity associated with that email. The vulnerability is addressed in version 12.128.2 by requiring email verification before security controls like 2FA can be configured.

Affected products

Cap-go capgo < 12.128.2

Timeline

2026-02-10: advisory: Initial GitHub security advisory published by vendor
2026-06-19: disclosed: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.