Unrated severityNVD Advisory· Published Jul 10, 2026· Updated Jul 10, 2026
Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
CVE-2026-56312
Description
Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-whc5-fvr7-g5v3mitrevendor-advisory
- www.vulncheck.com/advisories/capgo-account-creation-before-captcha-validation-in-accept-invitation-endpointmitrethird-party-advisory
News mentions
0No linked articles in our index yet.