CVE-2026-56212
CWE-269Published: June 20, 2026· Updated: Jun 23, 2026
Official Description
Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The application fails to verify the initiator's 2FA status before allowing the policy change, resulting in inconsistent security enforcement, potential administrative misuse, and lockout risk for team members.
Technical Analysis
CVE-2026-56212 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Related CVEs (CWE-269)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-56212 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts