Executive brief
Capgo, a platform for managing app updates and organizations, contained a security flaw where two-factor authentication (2FA) was only enforced on the user interface and not on the backend servers. This allowed administrative users to bypass mandatory security requirements and perform sensitive actions, such as changing organization details or inviting new users, without actually completing 2FA. This undermines the organization's security policies and could lead to unauthorized changes to account settings or access expansion.
Technical details
A business logic flaw in Capgo versions prior to 12.128.2 results in client-side enforcement of server-side security (CWE-602). While the web UI correctly prompts users to enable and complete 2FA before accessing organization settings, the underlying REST API endpoints for organization management (e.g., editing details, inviting users) do not validate the 2FA completion status. An authenticated attacker with Admin privileges can bypass the 2FA requirement by capturing and replaying or modifying API requests directly. This allows for unauthorized modification of organization data and user management even when 2FA is globally mandated by a Super Admin. The issue is resolved in version 12.128.2.
Affected products
- Capgo Capgo 0 to 12.128.1
Timeline
- 2026-02-10: advisory: Initial GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication and CVE assignment