Capgo EUVD-2026-38094

The vulnerability requires two specific conditions: (1) the Enforce Password Policy feature must be explicitly enabled within the Capgo organization by a Super Admin, and (2) the Super Admin must subsequently perform a compliant password change through the policy-driven reset flow. The flaw does not affect organizations where the password policy feature is disabled, and it does not affect non-Super Admin accounts. External unauthenticated attackers cannot trigger this condition - it is inherently self-inflicted by the highest-privileged account performing routine administrative configuration. Exploitation is further limited to Capgo versions before 12.128.2. The CVSS PR:H metric confirms the Super Admin privilege requirement. No network-level conditions, special protocol configurations, or external dependencies are required beyond the Capgo platform itself.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 6.9) accurately models the key risk trade-off: network accessibility with low complexity, but gated behind Super Admin privileges (PR:H). The availability impact is high because the lockout is permanent and affects organization-level administrative access, not just a single feature. No EPSS score was provided in the intelligence data, no CISA KEV listing exists, and no public proof-of-concept code has been identified, making real-world exploitation probability non-quantifiable from current data. The threat model is atypical: this is a self-triggered defect rather than an externally exploitable flaw - an attacker cannot force this condition on a victim without already holding Super Admin credentials. The practical severity is highest for organizations with a single Super Admin account, where the lockout could permanently disrupt administrative recovery operations. The absence of confidentiality or integrity impact limits the blast radius to operational disruption.

A Super Admin navigates to the Capgo organization settings, enables Enforce Password Policy, and proceeds through the mandated password-change flow, entering a new password that meets all policy requirements. The backend accepts the password as valid but fails to flip the compliance flag, so every subsequent login attempt immediately redirects the admin to the password-reset prompt. The Super Admin is permanently locked out of all organization management functions with no self-service recovery path, constituting a complete denial of administrative service.