Capgo fails to enforce a maximum value for the minimum password length in its password policy configuration. An authenticated organization administrator can set an astronomically high value, such as billions of characters, making it impossible for any user to meet the policy. Once the policy is enabled, all users, including administrators, are prevented from changing their passwords or accessing the organization, effectively locking the entire organization and causing an application‑level denial of service.

Capgo is affected for all releases prior to version 12.128.2. The vulnerability resides in the password policy configuration feature available to organization administrators.

The CVSS score is 6.9, indicating a moderate to high severity. EPSS is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Access requires authenticated privileged privileges; therefore the likely attacker is an insider or a compromised administrator account. If exploited, the impact is a complete lockout of the application for all users, leading to service disruption. The lack of an exploit probability metric suggests that active exploitation is not confirmed, but the potential damage warrants prompt mitigation.