Cap‑go versions prior to 12.128.2 contain an authentication logic flaw that lets an attacker register an account and bind it to a victim’s email address before the email is verified. Once the attacker enables two‑factor authentication on this pre‑registered account, they can assume control over the account claimed under the victim’s identity, read and modify its state, enforce organization‑level policies, and prevent the legitimate owner from accessing the account tied to their own email address. This reflects a high‑severity account takeover scenario amplified by a 2FA misconfiguration.

Cap‑go by Cap‑go, affecting all deployments running any version earlier than 12.128.2.

The CVSS score of 9.3 indicates a critical impact. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the potential for widespread account hijacking remains high. The likely attack vector is through the public account registration endpoint, where an attacker can provide a victim’s email address and subsequently enable 2FA before verification. An attacker in the role of a legitimate user can launch this without additional credentials, making exploitation straightforward for a motivated threat actor.