CVE-2026-56312: Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
Published Jul 10, 2026
·Updated
Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.
Affected Software
1 affected component
capgo<12.128.2
Event History
Jul 10, 2026
CVE Published
via MITRE·01:57 PM
Data Sourced
via MITRE·01:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-56312?
The severity of CVE-2026-56312 is classified as medium with a score of 6.9.
2
How do I fix CVE-2026-56312?
To fix CVE-2026-56312, update Capgo to version 12.128.2 or later.
3
What type of vulnerability is CVE-2026-56312?
CVE-2026-56312 is an improper validation vulnerability related to account creation before CAPTCHA validation.
4
What can attackers do with CVE-2026-56312?
Attackers can exploit CVE-2026-56312 to create unwanted user accounts by bypassing CAPTCHA protection.
5
Which endpoint is affected by CVE-2026-56312?
The affected endpoint in CVE-2026-56312 is the accept_invitation endpoint.