Capgo versions prior to 12.128.2 contain a flaw in the Enforce Password Policy feature. When a Super Admin enables the policy and later changes their password to meet the policy, the backend fails to update the password‑compliance state. Consequently the account remains marked as non‑compliant, triggering repeated password‑reset prompts that ultimately lock the Super Admin out of the organization, preventing any further legitimate access to the system while authentication is still technically valid.

Cap-go Capgo, specifically all releases before 12.128.2. The vulnerability is tied to the product’s authentication and password‑policy enforcement components, affecting only the enterprise levels that use the Super Admin role for policy management.

The flaw carries a CVSS score of 6.9, indicating moderate severity, with no EPSS score reported and it is not listed in the CISA KEV catalog. Attackers would need the ability to enable the password policy and then successfully change a Super Admin password to a compliant one; the vulnerability is internal and depends on administrative activity. Given the moderate CVSS and lack of public exploitation evidence, the likelihood of widespread exploitation is considered low to moderate, but the impact—permanent exclusion of all privileged users—demands prompt remediation.