LAGARTO CHIVATO · CVE-2026-126815 · Other
FIX → 0.4.4
Lagarto Chivato 0.4.1 and earlier, on its web interface, lets an attacker set a password on an unregistered email address. When the real owner of that address later signs in without a password, the attacker's password becomes valid and the attacker gets into the account.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Lagarto Chivato 0.4.1 or earlier with its web authentication flow exposed. The sources do not say whether the passwordless login path is enabled by default, so check the version and that login flow. unknown whether any other configuration limits exposure.
Not affected if unknown
Who cares lagarto-chivato, self-hosted, web
0.1.0 through 0.4.2 as affected and 0.4.4 as unaffected; the CVE text says 0.4.1 and earlierUpgrade to 0.4.4
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.4.4 as unaffected0.4.1 and earlier