---
id: CVE-2026-53981
title: Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism
summary: >-
  Cap-go prior to 12.128.2 contains an account takeover vulnerability in its
  email change mechanism that allows an attacker with temporary authenticated
  session access to change the registered email address without
  re-authentication such a…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-306
vendor: Cap-go
product: Cap-go
affected:
  - Cap-go < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-12T17:24:17.240226Z'
exploitAvailable: true
published: '2026-06-12'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:13.607Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53981'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-w56g-jv78-hf79'
    label: GitHub Security Advisory (GHSA-w56g-jv78-hf79)
  - url: >-
      https://github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e
  - url: >-
      https://www.vulncheck.com/advisories/cap-go-account-takeover-via-unauthenticated-email-change-mechanism
tags:
  - cve.org
  - exploit-available
epss: 0.00267
epssPercentile: 0.18885
ingestedAt: '2026-11-08T14:51:22.376Z'
---

## Overview

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

## Affected

- `Cap-go < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.