CVE-2026-56286: Capgo Auth Bypass Vulnerability

CVE-2026-56286 Overview

CVE-2026-56286 is an authentication bypass vulnerability in Capgo versions prior to 12.128.2. The account deletion endpoint processes deletion requests without requiring password re-authentication or any secondary verification step. Attackers can trigger account deletion through session hijacking, cross-site request forgery (CSRF), or parameter tampering. Successful exploitation results in unauthorized account removal, permanent data loss, and denial-of-service for affected users. The flaw maps to CWE-306: Missing Authentication for Critical Function and is exploitable over the network with user interaction.

Critical Impact
Attackers can permanently delete Capgo user accounts and associated data without providing the target's password, enabling account takeover follow-on and denial-of-service outcomes.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo deployments using the vulnerable account deletion endpoint
Capgo-based mobile update pipelines relying on affected user account management

Discovery Timeline

2026-06-30 - CVE-2026-56286 published to the National Vulnerability Database
2026-07-01 - Last updated in the NVD database

Technical Details for CVE-2026-56286

Vulnerability Analysis

The vulnerability resides in Capgo's account deletion workflow. The endpoint accepts and processes deletion requests using only the caller's existing session credential. It performs no password prompt, no email confirmation, and no multi-factor challenge before executing an irreversible destructive action. This design violates the principle of requiring stepped-up authentication for high-impact operations. Because Capgo is used as an over-the-air update platform for mobile applications, deletion of an operator account can also disrupt downstream update delivery. The result is unauthorized modification of account state and loss of availability. Full technical details are available in the GitHub Security Advisory GHSA-cjvr-jxp5-4p9x and the VulnCheck Advisory.

Root Cause

The root cause is missing authentication for a critical function ([CWE-306]). The deletion handler treats a valid session cookie or bearer token as sufficient authorization. It omits the re-authentication challenge that is standard practice for destructive account actions. Any attacker who can present a valid session context or coerce a browser into issuing an authenticated request can invoke the endpoint.

Attack Vector

Three exploitation paths are documented in the advisory. First, session hijacking allows an attacker who obtains a session token to issue a deletion request directly. Second, CSRF allows a remote attacker to trick an authenticated user into submitting a forged deletion request from a malicious page. Third, parameter tampering allows manipulation of identifiers passed to the endpoint when authorization checks are insufficient. All three vectors require only network access and minimal user interaction, matching the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:A.

No verified proof-of-concept exploit code has been published. Refer to the linked advisories for endpoint-specific request structure.

Detection Methods for CVE-2026-56286

Indicators of Compromise

Account deletion audit log entries lacking a preceding password verification or MFA event
Deletion requests originating from IP addresses or user agents that differ from the account owner's usual session context
HTTP requests to the account deletion endpoint carrying a Referer header pointing to an unknown external origin, consistent with CSRF
Sudden bursts of DELETE operations against user account records within a short time window

Detection Strategies

Correlate account deletion events with authentication events for the same user in the preceding minutes and alert when no re-authentication is observed
Inspect web server and reverse proxy logs for requests to the Capgo account deletion route and validate origin and referrer headers
Deploy CSRF detection rules that flag state-changing requests missing an anti-CSRF token or SameSite cookie enforcement

Monitoring Recommendations

Forward Capgo application logs and reverse proxy logs to a centralized SIEM for correlation across authentication and account lifecycle events
Alert on any account deletion outside of business hours or from a geolocation not previously associated with the account
Track deletion volume as a metric and set anomaly thresholds to surface bulk abuse

How to Mitigate CVE-2026-56286

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later without delay
Rotate all active session tokens after upgrading to invalidate any previously hijacked sessions
Audit account deletion logs from the past 90 days to identify unauthorized deletions and initiate data recovery where possible
Notify users to re-authenticate and review account activity

Patch Information

The fix is available in Capgo 12.128.2. The maintainers introduced authentication controls on the account deletion path as documented in GHSA-cjvr-jxp5-4p9x. Operators of self-hosted Capgo instances must apply the upgrade to remediate the vulnerability.

Workarounds

Place the account deletion endpoint behind a reverse proxy rule that requires a recent MFA claim before forwarding the request
Enforce SameSite=Strict on session cookies to reduce CSRF exposure until the upgrade is applied
Temporarily disable the account deletion endpoint at the web tier and process deletion requests through a manual, verified out-of-band workflow

bash

# Example nginx rule to block direct account deletion until patched
location ~* /api/.*/delete-account {
    if ($http_referer !~* "^https://your-capgo-domain/") {
        return 403;
    }
    add_header Set-Cookie "SameSite=Strict" always;
    limit_req zone=deletion burst=1 nodelay;
}