Unauthenticated Email Change Enables Account Takeover

CVE-2026-56308 affects Capgo versions before 12.128.2 and represents a critical account takeover vulnerability stemming from insufficient re-authentication controls. The vulnerability allows attackers with an active session cookie or authenticated browser access to change an account's email address without requiring password confirmation or verification of the current email. This is particularly dangerous because email addresses serve as the primary recovery mechanism for account access and password resets—changing it effectively locks the legitimate owner out while granting the attacker persistent control. Any organization using Capgo for application updates or configuration management exposes user accounts to unauthorized access, credential compromise, and potential lateral movement within connected systems.

While this vulnerability doesn't map directly to a specific MITRE ATT&CK technique, Casky's security skills would detect attack patterns associated with account manipulation and session exploitation by analyzing authentication logs for suspicious email modification requests, session anomalies, and account recovery attempts. Practitioners using Casky's Claude AI-powered analysis would identify indicators such as email change requests originating from unexpected geographic locations, multiple failed recovery attempts after legitimate email changes, or session tokens being leveraged for account modifications without corresponding password verification events. The extended reasoning capability would correlate these signals to surface the underlying authentication weakness—specifically the absence of step-up authentication (CWE-640: Weak or Missing Password Requirements) and help practitioners prioritize remediation to mandate password re-confirmation and email verification workflows before any email address modifications are processed.