CVE-2026-53982 describes an improper access control vulnerability (CWE-284) in Capgo Console's account deletion flow. When an attacker triggers account deletion while a device identifier is linked to the active session, the system erroneously marks the device as disabled. This results in denial-of-service by blocking authentication and onboarding functions on that device for approximately 30 days, redirecting users to an account-disabled page. The vulnerability affects versions prior to 12.28.2, although no explicit affected versions are provided. The CVSS 4.0 base score is 7.1, indicating high severity. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

The vulnerability causes a denial-of-service condition on affected devices or browser environments by preventing any account login or registration for about 30 days after triggering account deletion. This disrupts user access and onboarding processes, potentially impacting user experience and operational continuity. There is no indication of privilege escalation or data compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid triggering account deletion while a device identifier is linked to an active session. Monitor vendor communications for updates regarding patches or workarounds.