Executive brief
Capgo Console, a platform used for managing app updates and deployments, contains a flaw in its account deletion process. When a user deletes their account, the system mistakenly blocks the physical device or browser used for that action from accessing the service entirely. This prevents any future logins or new account registrations from that device for approximately 30 days, effectively locking legitimate users out of the platform.
Technical details
A denial-of-service (DoS) vulnerability exists in Capgo Console's account deletion workflow due to improper device identifier association. When a user initiates account deletion, the backend incorrectly flags the active session's device identifier as disabled or deleted alongside the user account. Consequently, any subsequent attempts to log in or register a new account from that same device or browser environment are redirected to an 'account-disabled' page for a duration of approximately 30 days. This occurs because the platform enforces a device-level restriction based on the soft-deleted state of the previous account. The issue is resolved in version 12.128.2 by decoupling device identity from the account deletion state.
Affected products
- Capgo Capgo Console < 12.128.2
Timeline
- 2026-03-08: advisory: GitHub Security Advisory published by vendor
- 2026-06-12: disclosed: CVE published and NVD record created