CVE-2026-56080 Details
Description
Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to a compliant one, the backend does not update the password-compliance state. As a result, the backend continues to treat the account as non-compliant and repeatedly forces password-reset prompts, permanently locking the Super Admin out of organization access (organization lockout / denial of service) despite valid authentication.
A critical authentication logic flaw has been identified in Capgo versions prior to 12.128.2, specifically within the Enforce Password Policy feature. When a Super Admin activates this policy and successfully updates their password to meet the requirements, the backend fails to recognize the compliance. Consequently, the account is incorrectly treated as non-compliant, causing a continuous loop of password-reset prompts. This flaw effectively locks the Super Admin out of organizational access, despite valid login credentials, creating a denial-of-service situation.
Capgo has released a patch in version 12.128.2. Users should update to this version to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-78rv-3cqj-36xq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-78rv-3cqj-36xq | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/cap-go-authentication-logic-flaw-in-enforce-password-policy | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |