CVE-2026-53982Medium· 6.5▾ SunlitCap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform incorrectly associates the deletion state with the device identifier, causing the affected device or browser environment to be redirected to an account-disabled page for approximately 30 days, preventing any account login or registration from that device.
capgo < 12.28.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53981High· 7.6Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism
CVE-2026-56073Critical· 9.4Cap-go - OTP Bypass via Response Manipulation in Email Verification
CVE-2026-56080Medium· 4.9Cap-go - Authentication Logic Flaw in Enforce Password Policy
CVE-2026-56081Critical· 9.1Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email
CVE-2026-56079Medium· 6.5Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access
CVE-2026-56082High· 7.5Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC