CVE-2026-53982: Cap-go Console Account Deletion DoS Vulnerability (CVSS 6.5)

Technical summary

The vulnerability exists in Cap-go Console's account deletion logic, which fails to properly segregate deletion state from device identifiers. The flaw manifests as a state-association error (CWE-645) where the platform binds the account-deleted flag to the device/browser environment rather than user identity. An authenticated attacker can exploit this by initiating account deletion with an active device session, causing the deletion state to persist at the device level. The affected device is then redirected to an account-disabled page for approximately 30 days, blocking all authentication and registration flows originating from that environment. This is a logic defect rather than a cryptographic or injection-based vulnerability.

Business impact

Organizations relying on Cap-go Console for device provisioning, onboarding, or account management face service disruption affecting end-user productivity. If an attacker compromises an account with user credentials, they can deny legitimate users access from shared or corporate devices for roughly a month. For organizations managing fleets of devices or supporting bring-your-own-device (BYOD) scenarios, widespread exploitation could disrupt onboarding pipelines and create friction in device authentication workflows. The 30-day lockout window is particularly disruptive for time-sensitive onboarding processes.

Affected systems

Cap-go Console versions prior to 12.28.2 are affected. The vulnerability requires authenticated access (PR:L in the CVSS vector), meaning the attacker must possess valid account credentials. Any device or browser environment linked to an active session during exploitation is susceptible to the 30-day lock-out condition.

Exploitability

Exploitability is moderate. The attack requires low-privilege authenticated access (valid account credentials) and no user interaction beyond triggering account deletion. The attack surface is network-based (AV:N) with low attack complexity (AC:L), making exploitation straightforward for any user with a Cap-go Console account. However, the impact is localized to the device or browser performing the deletion request, limiting the blast radius of a single attack. Systematic exploitation would require either multiple compromised accounts or coordinated attacks on targeted devices.

Remediation

Upgrade Cap-go Console to version 12.28.2 or later. This version corrects the state-association logic to bind account deletion state to user identity rather than device identifiers, eliminating the device-level lock-out condition. Verify the upgrade is applied across all Cap-go Console instances in your environment, including any self-hosted or on-premises deployments.

Patch guidance

Apply the upgrade to Cap-go Console 12.28.2 or newer as soon as possible. Prioritize patching in environments where account takeover or credential compromise is a concern, as these increase the likelihood of exploitation. Test the patch in a non-production environment first to confirm compatibility with dependent onboarding and authentication workflows. No workarounds are available; patching is the only remediation.

Detection guidance

Monitor for patterns of repeated account deletion attempts, particularly those initiated from the same device or IP address in short time windows. Log account deletion events paired with session identifiers and device identifiers to detect attempts to lock out devices systematically. Watch for user complaints about repeated authentication failures from specific devices despite valid credentials—this is a behavioral indicator of exploitation. Audit access logs for high-velocity deletion requests from low-privilege accounts, which may suggest credential compromise combined with exploitation attempts.

Why prioritize this

This is a medium-severity vulnerability (CVSS 6.5) that should be addressed in routine patch cycles but does not require emergency response. While the impact on availability is high (A:H in the vector), the requirement for authenticated access limits exposure. Prioritize patching if your organization supports high-volume device onboarding, shared device environments, or BYOD scenarios where the 30-day lock-out would cause significant operational friction. Lower priority for small teams with dedicated device management and strong credential hygiene.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a vulnerability with high availability impact but constrained exploitability. The requirement for authenticated access (PR:L) prevents unauthenticated exploitation, reducing the attack surface. Network-based delivery (AV:N) and low complexity (AC:L) make exploitation trivial once credentials are obtained, but the scope is unchanged (S:U), meaning the impact does not cross trust boundaries. The 30-day lock-out duration amplifies the availability harm, yet the device-level localization prevents organization-wide outages from a single attack. This profile—limited exposure, moderate impact, narrow scope—justifies a MEDIUM rating.

Frequently asked questions