CVE-2026-53868: Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion

Synopsis

This is a denial-of-service vulnerability in Capgo, the open-source live-update platform, affecting all versions before 12.128.2. An unauthenticated attacker can reach the registration and deletion API endpoints over the network with no credentials, register an account using any arbitrary email address without verifying ownership, and then trigger account deletion to lock that email in a pending-deletion state for 30 days. Successful exploitation permanently blocks the legitimate owner of that email address from accessing or creating a Capgo account for the duration of that hold period. A patched-image rebuild at version 12.128.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable registration and deletion endpoints are exposed over the network, so the attacker must be able to reach the service via a standard network connection.

• AuthenticationNot required

  No account or credentials are needed; the attack abuses the public account registration flow before any authentication occurs.

• Victim interactionNot required

  The attacker operates entirely through API calls and does not require the targeted user to click a link, open a file, or take any action.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are needed to lock an email address.

Blast Radius

• An attacker locks any chosen email address out of the Capgo platform for a 30-day pending-deletion hold, preventing the legitimate owner from registering or recovering access during that window.
• Legitimate users whose email is targeted lose access to Capgo-managed live-update deployments for the duration of the hold, disrupting their ability to ship or roll back app updates.
• The attack is repeatable against any number of email addresses with no per-attempt cost, allowing broad-scope disruption of user accounts across an organization.