CVE-2026-56308 Overview
CVE-2026-56308 is a broken authentication vulnerability in Capgo versions prior to 12.128.2. The email change endpoint accepts requests without requiring the account's current password or verification of the existing email address. An attacker who obtains a valid session cookie or gains access to an authenticated browser can rewrite the account email address. This action redirects password reset flows to attacker-controlled inboxes and bypasses multi-factor authentication (MFA) protections tied to account recovery. The weakness is classified under [CWE-640: Weak Password Recovery Mechanism for Forgotten Password].
Critical Impact
Attackers with a hijacked session can permanently take over Capgo accounts by pivoting through the email change endpoint to control password recovery and defeat MFA.
Affected Products
- Capgo versions prior to 12.128.2
- Self-hosted Capgo deployments running vulnerable releases
- Managed Capgo tenants on unpatched builds
Discovery Timeline
- 2026-07-12 - CVE-2026-56308 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-56308
Vulnerability Analysis
Capgo is an open-source live-update service for Capacitor mobile applications. The email change endpoint in versions before 12.128.2 performs a state-changing operation without step-up authentication. When an authenticated user submits a new email address, the server updates the account record based solely on the presence of a valid session token.
Because account recovery, password reset, and MFA fallback flows all depend on the registered email, control of that field is equivalent to control of the account. The attacker does not need the current password. They also do not need to interact with the existing mailbox, since the server does not send a confirmation link to the previous address before completing the change.
Root Cause
The root cause is missing re-authentication on a security-sensitive action. Sensitive account changes such as email or password updates should require the current credential or a fresh authentication factor. The Capgo endpoint trusts the session cookie for the entire operation and treats the email field like any other profile attribute.
Attack Vector
An attacker must first obtain an authenticated session. Practical paths include cross-site scripting on a related origin, session cookie theft through malware on the victim's device, or physical access to an unlocked browser. Once authenticated as the victim, the attacker issues an authenticated request to the email update endpoint and substitutes an attacker-controlled address. The attacker then triggers the standard password reset flow, receives the reset link at the new address, and locks the legitimate owner out. MFA does not block this path because the recovery workflow supersedes the second factor.
No public proof-of-concept exploit is currently listed for CVE-2026-56308. Refer to the GitHub Security Advisory GHSA-9px4-w25f-mvm4 and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-56308
Indicators of Compromise
- Email change events on Capgo accounts that are not preceded by a password prompt or step-up authentication event in application logs.
- Password reset requests immediately following an email address change on the same account within a short window.
- New email addresses on disposable or unfamiliar domains replacing previously verified corporate addresses.
- Successful logins from new IP addresses or user agents shortly before an email change request.
Detection Strategies
- Alert on any HTTP request to the Capgo email update endpoint that is not part of a documented administrative workflow.
- Correlate email_change events with recent session creation, geolocation shifts, and absence of a preceding re-authentication event.
- Flag account recovery attempts that occur within minutes of an email change as high-risk sequences.
Monitoring Recommendations
- Ingest Capgo application and authentication logs into a centralized logging platform and retain them for at least 90 days.
- Monitor for bulk email changes across multiple accounts originating from the same IP address or autonomous system.
- Track MFA enrollment resets and password resets that follow email changes and require analyst review before completion.
How to Mitigate CVE-2026-56308
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later on all self-hosted and managed instances.
- Invalidate all active sessions after upgrading to force re-authentication with current credentials.
- Audit recent email change events across accounts and contact users whose addresses changed without a corresponding support ticket.
- Reset passwords and re-enroll MFA for any account showing suspicious email modifications.
Patch Information
The fix is included in Capgo 12.128.2. The patched release requires re-authentication on the email change endpoint and adds verification of the existing email address before completing the update. See the GitHub Security Advisory GHSA-9px4-w25f-mvm4 for release notes and commit references.
Workarounds
- Restrict access to the Capgo administration interface using network controls or a reverse proxy that enforces IP allowlisting until patching completes.
- Disable self-service email changes at the application or proxy layer and require support-driven changes with out-of-band verification.
- Shorten session lifetimes and enforce reauthentication on sensitive routes through an edge policy where possible.
- Enable phishing-resistant MFA and monitor for account recovery events to detect abuse attempts against unpatched instances.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
