EUVD-2026-38094
GHSA-q28q-5xw5-9f2r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible flaw gated behind Super Admin privileges (PR:H); only availability impacted as the lockout causes no confidentiality or integrity consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to a compliant one, the backend does not update the password-compliance state. As a result, the backend continues to treat the account as non-compliant and repeatedly forces password-reset prompts, permanently locking the Super Admin out of organization access (organization lockout / denial of service) despite valid authentication.
AnalysisAI
Capgo's Enforce Password Policy feature in versions before 12.128.2 permanently locks Super Admins out of their organization through a backend state management flaw, constituting a targeted denial-of-service against administrative access. When a Super Admin enables the password policy and successfully changes their password to a policy-compliant value, the backend fails to mark the account compliant, trapping the account in an infinite forced-password-reset loop and severing all organization management access. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.9 reflects the high-privilege prerequisite and pure availability impact with no confidentiality or integrity consequence.
Technical ContextAI
Capgo is a mobile application live-update platform (CPE: cpe:2.3:a:cap-go:capgo:*:*:*:*:*:*:*:*). The vulnerability resides in the backend logic governing the Enforce Password Policy feature's compliance-state lifecycle. Under CWE-287 (Improper Authentication), the authentication state machine incorrectly persists a 'non-compliant' flag after a legitimate and successful password change has been completed. The backend should atomically update the account's compliance status upon confirming a valid compliant password, but this transition is absent. As a result, the authentication flow continuously redirects the Super Admin to the password-reset prompt regardless of credential validity, breaking the expected post-change session state and locking the administrator out of all organization-scoped operations.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the backend compliance-state update failure per vendor GitHub Security Advisory GHSA-78rv-3cqj-36xq (https://github.com/Cap-go/capgo/security/advisories/GHSA-78rv-3cqj-36xq). For organizations unable to patch immediately, the most targeted compensating control is to disable or defer enabling the Enforce Password Policy feature until the upgrade is applied, as the flaw is only triggered by activating this specific feature; note that this reduces password governance posture and may conflict with compliance requirements. Organizations with multiple Super Admin accounts should ensure at least one secondary Super Admin is enrolled and not subject to the lockout, preserving recovery access in the event a primary admin account is trapped in the reset loop.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today