CVE-2026-56081 describes a critical authentication logic vulnerability in Cap-go's password recovery mechanism prior to version 12.128.2. The issue arises because the system permits registration and control of an account bound to a victim's email address before verifying that email. By exploiting this, an attacker can enable two-factor authentication on the pre-registered account, gaining unauthorized control over the victim's account and its associated privileges, including organization-level policy enforcement. This vulnerability can lead to account takeover and denial of access for the legitimate user.

An attacker exploiting this vulnerability can take over accounts tied to victim email addresses without prior verification. This results in unauthorized access to sensitive account information and the ability to modify account state and enforce organization-level policies. The legitimate user is denied access to their own account, leading to potential data loss, privacy breaches, and administrative control compromise. The CVSS 4.0 score of 9.3 reflects a critical impact with network attack vector, no required privileges or user interaction, and high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or temporary mitigation currently documented. Until a patch or official guidance is provided, organizations should monitor for suspicious account registration activity and consider additional verification controls if possible. Avoid enabling two-factor authentication on accounts before email verification is confirmed.