# CVE-2026-56080: Cap-go capgo denial of service via password policy lockout

Source: https://junglewise.ai/threats/cve-2026-56080-cap-go-capgo-denial-of-service-via-password-policy-lockout  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56080 · Severity: medium · CVSS 4.9 · Published 2026-06-19

Capgo, a platform for managing app updates and organization settings, contains a flaw in its password policy enforcement. When an administrator enables strict password requirements and updates their own password to comply, the system fails to recognize the update and enters an infinite loop of password reset prompts. This effectively locks the administrator out of their own organization, preventing them from managing users, billing, or security settings.

## Quick answers

**Is CVE-2026-56080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56080 being exploited in the wild.

**How severe is CVE-2026-56080?** Medium severity, with a CVSS score of 4.9, published 19 June 2026.

**Which products and versions are affected?** Cap-go capgo < 12.128.2.

**Is there a fix for CVE-2026-56080?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56080 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-56080?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication logic flaw exists in Capgo's 'Enforce Password Policy' feature due to a failure in the backend to update the password-compliance state. When a Super Admin enables the policy and successfully changes their password to a compliant one, the backend continues to flag the account as non-compliant. This results in a persistent denial-of-service (lockout) where the user is trapped in a forced password-reset loop despite providing valid, compliant credentials. The vulnerability is tracked as CWE-287 and was addressed in version 12.128.2.

## Affected products

- Cap-go capgo < 12.128.2

## Timeline

- 2026-02-10: advisory: Initial GHSA advisory published
- 2026-06-19: disclosed: CVE published to NVD

## References

- [https://github.com/Cap-go/capgo/security/advisories/GHSA-78rv-3cqj-36xq](https://github.com/Cap-go/capgo/security/advisories/GHSA-78rv-3cqj-36xq)
- [https://www.vulncheck.com/advisories/cap-go-authentication-logic-flaw-in-enforce-password-policy](https://www.vulncheck.com/advisories/cap-go-authentication-logic-flaw-in-enforce-password-policy)