{"id":"CVE-2026-126815","kind":"vulnerability","aliases":["CVE-2026-126815"],"related":[],"title":"Lagarto Chivato: pre-account hijacking lets attackers take over accounts","description":"Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.","summary":"Lagarto Chivato 0.4.1 and earlier, on its web interface, lets an attacker set a password on an unregistered email address. When the real owner of that address later signs in without a password, the attacker's password becomes valid and the attacker gets into the account.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Lagarto Chivato","fixed":["0.4.4"],"affected":">= 0.1.0, <= 0.4.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["lagarto-chivato","other","self-hosted","web"],"not_affected_if":["unknown"],"how_to_check":"Check the installed Lagarto Chivato version. NVD's CNA table lists 0.1.0 through 0.4.2 as affected and 0.4.4 as unaffected; the CVE text says 0.4.1 and earlier. Then see whether passwordless (email) sign-in is enabled and whether a password can be set on an email address that has no account yet.","fix":"NVD's CNA record lists 0.4.4 as unaffected. No vendor or maintainer page confirms it; the CVE text itself only says 0.4.1 and earlier.","status":"open","published_at":"2026-11-11T20:17:07+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:12+00:00","updated_at":"2026-11-11T20:31:39+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T20:30:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Lagarto Chivato: pre-account hijacking lets attackers take over accounts","impact":"high","summary":"Lagarto Chivato 0.4.1 and earlier, on its web interface, lets an attacker set a password on an unregistered email address. When the real owner of that address later signs in without a password, the attacker's password becomes valid and the attacker gets into the account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["lagarto-chivato","web","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes over victim accounts, reading and acting as the user","analyst_note":"Confirm the fixed version and whether passwordless login is default-on, using the NVD entry and the vendor's advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Lagarto Chivato 0.4.1 or earlier with its web authentication flow exposed. The sources do not say whether the passwordless login path is enabled by default, so check the version and that login flow. unknown whether any other configuration limits exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4557,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether passwordless login is default-on, using the NVD entry and the vendor's advisory.","search":"'-126815':14A,17A '-2026':13A,16A '0.4.1':30B,85C 'account':5A,11A,73B,76C,98C 'address':47B,54B,107C 'allow':90C 'arbitrari':97C 'attack':8A,39B,62B,69B,93C 'authent':80C 'becom':65B,109C 'chivato':2A,19A,22B,29B,84C 'cve':12A,15A 'earlier':32B,87C 'email':46B,106C 'first':115C 'flow':81C 'get':70B 'hijack':6A,77C 'host':26B 'interfac':36B 'lagarto':1A,18A,21B,28B,83C 'lagarto-chivato':20B 'later':55B 'let':7A,37B 'login':117C 'owner':51B 'password':42B,60B,64B,101C 'passwordless':116C 'plant':102C 'pre':4A,75C 'pre-account':3A,74C 'real':50B 'remot':91C 'self':25B 'self-host':24B 'set':40B 'sign':56B 'take':9A,95C 'unauthent':92C 'unregist':45B,105C 'upon':111C 'valid':66B,110C 'via':99C 'victim':113C 'web':27B,35B,89C 'without':58B","nicknames":[],"mitigations":[],"who_affected":"Teams running Lagarto Chivato 0.4.1 or earlier with its web authentication flow exposed. The sources do not say whether the passwordless login path is enabled by default, so check the version and that login flow. unknown whether any other configuration limits exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["chivato","lagartochivato"],"ptokens":["chivato","lagarto"],"labels":["high","lagartochivato","other","selfhosted","web"],"campaign_type":null,"search_a":"'-126815':14A,17A '-2026':13A,16A 'account':5A,11A 'attack':8A 'chivato':2A,19A 'cve':12A,15A 'hijack':6A 'lagarto':1A,18A 'let':7A 'pre':4A 'pre-account':3A 'take':9A","search_b":"'0.4.1':30B 'account':73B 'address':47B,54B 'attack':39B,62B,69B 'becom':65B 'chivato':22B,29B 'earlier':32B 'email':46B 'get':70B 'host':26B 'interfac':36B 'lagarto':21B,28B 'lagarto-chivato':20B 'later':55B 'let':37B 'owner':51B 'password':42B,60B,64B 'real':50B 'self':25B 'self-host':24B 'set':40B 'sign':56B 'unregist':45B 'valid':66B 'web':27B,35B 'without':58B","search_c":"'0.4.1':85C 'account':76C,98C 'address':107C 'allow':90C 'arbitrari':97C 'attack':93C 'authent':80C 'becom':109C 'chivato':84C 'earlier':87C 'email':106C 'first':115C 'flow':81C 'hijack':77C 'lagarto':83C 'login':117C 'password':101C 'passwordless':116C 'plant':102C 'pre':75C 'pre-account':74C 'remot':91C 'take':95C 'unauthent':92C 'unregist':105C 'upon':111C 'valid':110C 'via':99C 'victim':113C 'web':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"772f0079-75c2-41ca-913e-d9072716578b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126815","severity":null,"published_at":"2026-11-11T20:17:07+00:00","modified_at":"2026-11-11T20:17:07+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126815:3593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126815","severity":null,"published_at":"2026-11-11T20:31:39+00:00","modified_at":"2026-11-11T20:31:39+00:00","first_seen_at":"2026-11-11T20:31:39+00:00","fetched_at":"2026-11-11T20:31:39+00:00","note":"Only source is the NVD record (CNA Grayback). Its description says 0.4.1 and earlier, but its affected-products table says 0.1.0 through 0.4.2 affected and 0.4.4 unaffected. Grayback's advisories page and the XauenDevs GitHub did not list the issue, so I found no vendor or maintainer page. Nothing marked verified. Passwordless login default unknown.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-126815"]}],"documents":[{"id":128725,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126815","title":"NVD CVE-2026-126815 (CNA: Grayback)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}