Executive brief
Capgo, a platform for managing app updates, is affected by a flaw that allows anyone to block legitimate users from accessing the service. By registering an account with a victim's email address and immediately requesting its deletion, an attacker can lock that email address for 30 days. This prevents real customers from signing up or logging in, potentially leading to significant operational disruption and loss of user trust.
Technical details
A denial of service (DoS) vulnerability exists in Capgo versions prior to 12.128.2 due to missing authentication and verification during critical account lifecycle operations. The application allows unauthenticated attackers to register accounts using any email address without requiring proof of ownership. Once registered, the system permits the attacker to initiate an account deletion, which places the email address into a 'pending deletion' state for 30 days. During this period, the legitimate owner of the email is barred from registering or accessing the platform, as the system identifies the user as already existing but disabled. This flaw is categorized under CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). A fix is available in version 12.128.2.
Affected products
- Capgo Capgo console before 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD