CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
Attackers can bypass CAPTCHA validation to create unauthorized accounts and consume invite links in Capgo applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56312?
CVE-2026-56312 is a medium-severity vulnerability in Capgo, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.
Weakness: CWE-287
Which versions are affected by CVE-2026-56312?
How do I fix CVE-2026-56312?
No fix has been published for CVE-2026-56312 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56312 being exploited?
There is no known exploitation of CVE-2026-56312 in the wild and no public exploit code.
Sources
Also known as GHSA-pj32-crq8-r292, GHSA-whc5-fvr7-g5v3.