Capgo prior to version 12.128.2 contains an improper validation flaw in the accept_invitation endpoint that allows account creation before captcha verification is enforced. As a result, attackers can submit POST requests with invalid or missing captcha tokens to create unauthorized user accounts and consume invitation links without authorization, which aligns with CWE-287, an authentication bypass weakness. This flaw can be exploited to flood the system with bogus accounts or to exhaust invitation limits, undermining the integrity of user management.

All deployments of Capgo that have not applied a release newer than 12.128.2 are affected. The vulnerability is present in the core server logic regardless of operating system, container runtime, or cloud hosting environment; thus, any user hosting that version is potentially exposed.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacks do not require privileged credentials or sophisticated tooling; attackers only need to know the accept_invitation endpoint URL and the ability to send standard HTTP POST requests, indicating a low barrier to entry and making the vulnerability relatively easy to exploit if the conditions are met.