CVE-2026-53868: Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion
Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53868?
The severity of CVE-2026-53868 is rated as high with a score of 8.7.
How does CVE-2026-53868 impact Capgo users?
CVE-2026-53868 allows attackers to lock legitimate users out of their accounts by registering and deleting accounts using unverified email addresses.
How can I mitigate CVE-2026-53868 in my Capgo deployment?
To mitigate CVE-2026-53868, update your Capgo software to version 12.128.2 or later, which resolves the vulnerability.
What type of vulnerability is CVE-2026-53868?
CVE-2026-53868 is a denial of service vulnerability.
What are the potential consequences of exploiting CVE-2026-53868?
Exploiting CVE-2026-53868 can result in legitimate users being permanently locked out of their accounts.