Vulnerability · Published Jun 12, 2026 · Assigned by VulnCheck

CVE-2026-53868Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion

High 7.5

In plain English

A high-severity missing authentication in Capgo from Capgo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GHSA Advisory GHSA-3wfv-m8fq-7r5g vendor-advisory
VulnCheck Advisory: Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion third-party-advisory