The vulnerability resides in the POST /app/demo endpoint of Capgo. Authenticated users who possess organization write permissions can create an unlimited number of demo applications because the system lacks rate limiting or quota enforcement. Each request triggers roughly 138 database write operations, which can strain the database, degrade overall performance, increase operational costs, and eventually cause service instability.

Capgo’s Capgo product is affected. Versions earlier than 12.128.2 contain the flaw, while 12.128.2 and later contain the fix.

The CVSS score of 5.3 represents a medium severity threat. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to be authenticated and have organization‑write permissions to exploit it; they can repeatedly invoke the unprotected endpoint to trigger repeated bursts of database writes, leading to a denial of service condition. The risk is moderate, but impact can be significant if the system cannot absorb the load.