CVE-2026-53981

High

Description

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

SeverityHigh

CVSS7.6

Exploit probability—

ProductCap-go

PublishedJun 12, 2026

First seenJun 12, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

Cap-go Cap-go12.128.2 or later

Patches

github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e

Vendor advisories

github.com/Cap-go/capgo/security/advisories/GHSA-w56g-jv78-hf79

Affected products

Product	Affected versions	Fixed in
Cap-go Cap-go	v < 12.128.2	12.128.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.