CyberRota Analysis
AI-GeneratedCapgo versions prior to 12.128.2 are vulnerable to unauthorized email address changes, as the system does not require current password re-authentication or verification of the existing email. This flaw allows an attacker with access to a valid session cookie or authenticated browser to take control of account recovery processes, effectively bypassing multi-factor authentication protections. Organizations using affected versions should prioritize patching this vulnerability to safeguard user accounts and sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with access to a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.