Capgo CVE-2026-56228

Exploitation strictly requires an active authenticated session holding the organization administrator role within the target Capgo organization - this is the definitive prerequisite confirmed by the CVSS 4.0 PR:H metric. The denial of service is triggered only when the attacker both sets an extreme minimum password length value AND explicitly enables the policy; setting the value alone without activation does not cause the lockout. The impact is scoped to a single organization and does not affect other organizations on the same Capgo deployment or the underlying platform infrastructure. Standard authenticated users without the administrator role cannot access the password policy configuration and therefore cannot trigger this vulnerability. The attack vector is network-accessible (AV:N), meaning the attacker does not require local or physical access - any network-reachable Capgo web interface is sufficient once admin credentials are in hand.

The CVSS 4.0 score of 6.9 (Medium) accurately reflects the elevated privilege requirement (PR:H - organization administrator role) as the principal attack constraint, which substantially narrows the exploitable population compared to an unauthenticated flaw. Attack complexity is Low (AC:L) and no attack requirements exist (AT:N), meaning any administrator who can reach the web interface can trivially trigger the condition. Impact is exclusively high-severity availability loss (VA:H) on the vulnerable system - confidentiality and integrity are unaffected across both vulnerable and subsequent systems. No EPSS data was provided in the source intelligence, and this CVE does not appear in the CISA KEV catalog, meaning no confirmed widespread or targeted active exploitation has been documented. No public POC has been identified. The realistic threat model centers on insider abuse, privilege escalation from a lower role, or a compromised administrator credential - not opportunistic external attackers. Organizations with shared, poorly rotated, or externally phishable admin credentials face materially higher exposure than the base CVSS score alone implies, because a single compromised admin account is sufficient to lock out an entire organization.

An attacker who has obtained organization administrator credentials - through phishing, credential stuffing, or insider access - logs into the Capgo web interface, navigates to the organization's password policy settings, enters an integer value such as 2,000,000,000 as the minimum password length, and enables the policy. From that moment, all organization members encounter an unresolvable password compliance failure on any password change attempt, locking out the entire organization with no self-service recovery path. The attack requires only standard authenticated web UI interaction and no specialist tooling or exploit code.