Capgo before version 12.128.2 allows attackers to create accounts using arbitrary email addresses that are not verified, and then to delete them, leaving the email locked in a pending deletion state. This process can be repeated to lock valid users out of the platform for 30 days, effectively denying them access. The weakness is a mismanagement of user ownership verification, corresponding to CWE-306. The impact is a prolonged, service‑disruption scenario that affects user availability without compromising data confidentiality or integrity.

All installations of Capgo with a release prior to 12.128.2 are vulnerable. No granular version information was supplied, so any deployment that has not upgraded to at least 12.128.2 remains at risk.

The CVSS score of 8.7 indicates a high‑severity vulnerability. No EPSS score is available, but the lack of require verification and the ability to force a pending deletion state suggest a high likelihood of exploitation. The attack vector is likely through the public registration and deletion APIs; an attacker needs only to supply an arbitrary email address and can carry out the attack from any reachable location. The vulnerability is not listed in the CISA KEV catalog, but the potential for a sustained denial of service makes it a priority for remediation.