CVE-2026-56256: Capgo - Two-Factor Authentication Bypass via Organization Management API
Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, bypassing the globally enforced 2FA requirement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56256?
The severity of CVE-2026-56256 is rated high with a score of 7.1.
What are the potential exploits of CVE-2026-56256?
CVE-2026-56256 can be exploited by an authenticated Admin user to bypass two-factor authentication when accessing sensitive Organization management APIs.
How do I fix CVE-2026-56256?
To fix CVE-2026-56256, update to Capgo version 12.128.2 or later, where mandatory two-factor authentication is enforced on the backend.
What systems are affected by CVE-2026-56256?
CVE-2026-56256 affects Capgo versions prior to 12.128.2.
What impact does CVE-2026-56256 have on my organization?
The impact of CVE-2026-56256 allows unauthorized access to sensitive actions like editing organization details and inviting users without 2FA validation.