Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56212Capgo - Improper 2FA Enforcement Logic via Team Security Settings

Low 3.8

In plain English

A low-severity privilege mismanagement in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The application fails to verify the initiator's 2FA status before allowing the policy change, resulting in inconsistent security enforcement, potential administrative misuse, and lockout risk for team members.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-w2cr-vcwj-69x2) vendor-advisory
VulnCheck Advisory: Capgo - Improper 2FA Enforcement Logic via Team Security Settings third-party-advisory