Capgo before 12.128.2 has a flaw in the channel_self API that allows attackers to bypass server‑side rate limiting by rotating a user‑controlled device_id value on each request. By rapidly changing device_id an attacker can send an unlimited number of requests per second, filling the channel_devices table and exhausting database resources. This results in denial of service for legitimate users and may impact overall system availability. The weakness is an instance of improper resource limiting (CWE-770).

The vulnerability affects the Capgo Capgo application for all versions earlier than 12.128.2. Attackers must target the public channel_self endpoint exposed by the Capgo service.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS score means current exploit probability is unknown but the vulnerability remains high risk due to its potential for DoS. It is not listed in CISA’s KEV catalog. The likely attack vector is external network traffic to the channel_self endpoint, as the endpoint accepts user input and does not enforce strict limits on request rate when device_id changes.