Medium severity6.5NVD Advisory· Published Jul 10, 2026· Updated Jul 10, 2026

CVE-2026-56312

Description

Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

Affected products

Cap Go/Capgo.appllm-fuzzy
Range: <12.128.2

Patches

Vulnerability mechanics

References

github.com/Cap-go/capgo/security/advisories/GHSA-whc5-fvr7-g5v3nvd
www.vulncheck.com/advisories/capgo-account-creation-before-captcha-validation-in-accept-invitation-endpointnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000