CVE-2026-56212
Fresh advisory, vendor patch, but no PoC, KEV, or independent confirmation of real-world impact.
What: Capgo before 12.128.2 contains an authentication logic flaw allowing users with team/organization security settings permissions to bypass or improperly enforce two-factor authentication.
Why it matters: Published today (June 20, 2026); vendor has released a patched version (12.128.2), signaling acknowledged severity. No KEV listing, CVSS/EPSS, or public PoC in the chatter yet. Social signal is pure feed amplification of the CVE identifier with no independent analysis or exploitation reports.
Where it's seen: Automated CVE feed posts on X and Bluesky repeating the advisory text verbatim; no security researcher commentary, defender questions, or incident reports visible.
RISK: MODERATE — Vendor patched; affects authentication enforcement, but scope limited to privileged users.
No NVD details ingested for this CVE yet.