CVE-2026-56286 Capgo - Account Deletion Without Password Confirmation
Attackers can delete user accounts without password confirmation, causing data loss and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-56286?
CVE-2026-56286 is a high-severity missing authorization vulnerability in Capgo, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.
Weakness: CWE-306
Which versions are affected by CVE-2026-56286?
How do I fix CVE-2026-56286?
No fix has been published for CVE-2026-56286 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56286 exists.
Sources
Also known as GHSA-7799-99mf-pchj, GHSA-cjvr-jxp5-4p9x.