CVE-2026-56081 describes a critical authentication logic vulnerability in Cap-go before version 12.128.2. The vulnerability arises because the system permits account registration bound to a victim's email address without prior email verification. An attacker exploits this by pre-registering an account with the victim's email, then enabling two-factor authentication on that account. This grants the attacker full control over the victim's account, including reading and modifying account state and enforcing organization-level policies, effectively locking out the legitimate user. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

An attacker can gain unauthorized control over a victim's account by exploiting the weak password recovery mechanism. This control includes reading and modifying account data and enforcing policies at the organization level. The legitimate user is denied access to their own account, resulting in account takeover and potential organizational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor for suspicious account registrations and consider implementing additional verification steps for account recovery and registration processes. Avoid relying solely on email verification for account binding. Follow vendor updates closely for an official patch or mitigation instructions.