Executive brief
Capgo, a platform for managing app updates and organization settings, contains a flaw in its password policy enforcement. When an administrator enables strict password requirements and updates their own password to comply, the system fails to recognize the update and enters an infinite loop of password reset prompts. This effectively locks the administrator out of their own organization, preventing them from managing users, billing, or security settings.
Technical details
An authentication logic flaw exists in Capgo's 'Enforce Password Policy' feature due to a failure in the backend to update the password-compliance state. When a Super Admin enables the policy and successfully changes their password to a compliant one, the backend continues to flag the account as non-compliant. This results in a persistent denial-of-service (lockout) where the user is trapped in a forced password-reset loop despite providing valid, compliant credentials. The vulnerability is tracked as CWE-287 and was addressed in version 12.128.2.
Affected products
- Cap-go capgo < 12.128.2
Timeline
- 2026-02-10: advisory: Initial GHSA advisory published
- 2026-06-19: disclosed: CVE published to NVD