CVE-2026-56080: Capgo Password Policy Enforcement Bug Causes Super Admin Lockout

Technical summary

The vulnerability stems from a state-synchronization failure in Capgo's password compliance verification logic. When the Enforce Password Policy feature is activated and a Super Admin successfully changes their password to a compliant value, the backend's password-compliance state machine does not update. Consequently, subsequent authentication attempts trigger persistent password-reset enforcement, creating an authentication loop that denies access to organization resources. The root cause is classified under CWE-287 (Improper Authentication), indicating that the backend's validation of password compliance does not correctly reflect the actual compliance state after a valid password change.

Business impact

This vulnerability directly threatens administrative continuity and organizational availability. Super Admins managing Capgo deployments who enable the password policy feature risk permanent lockout from their organization, with no straightforward recovery path during the window before patching. The impact escalates in organizations with single Super Admin accounts or limited administrative redundancy. While the vulnerability requires High privilege to trigger (the Super Admin must enable the policy themselves), the consequence—complete loss of administrative access—is severe enough to warrant immediate remediation before policy activation.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability is triggered only after a Super Admin explicitly enables the Enforce Password Policy feature, meaning organizations that have not yet activated this feature are not exposed to the immediate risk. However, any deployment planning to enable password policies should upgrade before doing so.

Exploitability

Exploitation requires High privilege (Super Admin credentials) and is entirely network-accessible. No user interaction is needed beyond the Super Admin's intentional password change to comply with the policy. The attack surface is therefore limited to Super Admin accounts within organizations using Capgo, and the vector is straightforward: enable policy, change password to compliant value, and observe the lockout. The low complexity and high-privilege requirement mean exploitation is unlikely from external threat actors but poses a significant operational risk to administrators managing their own deployments.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch corrects the backend's password-compliance state tracking, ensuring that after a valid compliant password change, the account is properly marked as compliant and no further password-reset prompts are issued. Organizations should apply the patch before enabling the Enforce Password Policy feature, or if the feature is already active and a Super Admin is locked out, the patch should be prioritized for immediate deployment.

Patch guidance

Deploy Capgo 12.128.2 or later in your environment. If a Super Admin is currently locked out due to this issue, the patch will resolve the persistent reset-prompt loop upon deployment and re-authentication. Verify the patch version in your release notes or vendor documentation to confirm the fix is included. Consider staging the upgrade in a test environment first if your deployment allows, then roll out to production. After patching, affected Super Admins should be able to authenticate and access their organization normally.

Detection guidance

Monitor Capgo audit logs for repeated password-reset prompts originating from the same Super Admin account in a short time window, particularly following an Enforce Password Policy activation. A Super Admin repeatedly triggering or receiving password-reset enforcement despite having recently changed their password is an indicator of this issue. Operational indicators include Super Admin lockout reports immediately after enabling the password policy feature and failed authentication attempts cycling back to password-reset screens. Cross-reference enabled features in your Capgo configuration to identify if password policy enforcement is active.

Why prioritize this

Although the CVSS score is 4.9 (MEDIUM), the vulnerability merits high prioritization in practice due to the administrative context. Loss of Super Admin access to an organization is operationally critical, regardless of the numeric severity rating. The fix is straightforward (upgrade to 12.128.2), and the window of exposure is limited to organizations actively using the password policy feature. Prioritize upgrading any Capgo deployment in which the Enforce Password Policy feature is currently or imminently enabled.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a MEDIUM severity: Network-accessible (AV:N), Low attack complexity (AC:L), High privilege required (PR:H), no user interaction needed (UI:N), no scope change (S:U), no confidentiality or integrity impact (C:N, I:N), but High availability impact (A:H). The High availability impact accounts for the denial-of-service nature of the lockout. The score appropriately weights the privilege requirement (limiting external attack surface) against the severity of the outcome (organizational lockout). However, in a risk context, administrative access denial may warrant higher operational priority than the numeric score alone suggests.

Frequently asked questions