Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The application fails to verify the initiator's 2FA status before allowing the policy change, resulting in inconsistent security enforcement, potential administrative misuse, and lockout risk for team members.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cap-go |
|
No data.
No data.
References
History
Wed, 24 Jun 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cap-go
Cap-go cap-go |
|
| Vendors & Products |
Cap-go
Cap-go cap-go |
Tue, 23 Jun 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Sat, 20 Jun 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The application fails to verify the initiator's 2FA status before allowing the policy change, resulting in inconsistent security enforcement, potential administrative misuse, and lockout risk for team members. | |
| Title | Capgo - Improper 2FA Enforcement Logic via Team Security Settings | |
| Weaknesses | CWE-269 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-06-20T00:14:36.146Z
Updated: 2026-06-23T02:28:50.597Z
Reserved: 2026-06-19T21:43:24.736Z
Link: CVE-2026-56212
Vulnrichment
Updated: 2026-06-23T02:28:45.937Z
NVD
No data.
Redhat
No data.