CVE-2026-53981: Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism

Synopsis

An authentication-bypass flaw in the email change mechanism of Cap-go allows an attacker who holds any low-privilege session to reassign the account's registered email address without re-verifying their password or MFA. By redirecting the verification link to an attacker-controlled address and then triggering a password reset, the attacker permanently takes over the victim's account. A patched-image rebuild at version 12.128.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Cap-go service over the network; the CVSS vector specifies AV:N, meaning no local or physical access to the host is necessary.

• AuthenticationRequired

  The attacker must hold a low-privilege authenticated session (PR:L); any valid account, including a freshly created or temporarily compromised one, is sufficient.

• Victim interactionNot required

  No action from a victim user is needed to trigger the email change; the attacker operates entirely through their own session (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions to succeed.

Blast Radius

• The attacker reads account credentials and any data accessible to the victim's session after completing the password reset (VC:H).
• The attacker modifies the account's registered email and password, permanently locking the legitimate owner out of their account (VI:L).
• Service availability for the victim account is degraded as the legitimate user loses access (VA:L).
• No impact on systems or data outside the directly compromised Cap-go instance is indicated by the CVSS vector (SC:N, SI:N, SA:N).