The vulnerability in Capgo prior to version 12.128.2 (CVE-2026-56308) permits an attacker who has access to a valid session cookie or authenticated browser session to change the email address associated with an account without re-authentication or verification of the current email. This flaw enables the attacker to hijack account recovery mechanisms and circumvent multi-factor authentication, thereby escalating their control over the account. The issue is classified under CWE-640 (Weak Password Recovery Mechanism). No patch or official fix information is provided in the available data.

An attacker with a valid session or authenticated browser can change the email address on an account without needing the current password or email verification. This allows the attacker to take over account recovery processes and bypass multi-factor authentication protections, potentially leading to full account compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated sessions and session cookies, and monitor for suspicious account email changes. Avoid sharing session tokens and enforce strict session management policies.