CVE-2026-56080 Overview
CVE-2026-56080 is an authentication logic flaw in Capgo versions before 12.128.2. The vulnerability resides in the Enforce Password Policy feature. After a Super Admin enables the policy and changes their password to a compliant value, the backend fails to update the password-compliance state. The account remains flagged as non-compliant and is repeatedly prompted to reset its password. This loop permanently locks the Super Admin out of organization access despite valid authentication. The issue is classified under [CWE-287] Improper Authentication and results in organization-wide denial of service. The flaw requires high privileges and network access but no user interaction to trigger.
Critical Impact
A Super Admin account becomes permanently locked out of organization management functions, causing a denial-of-service condition for the entire Capgo organization.
Affected Products
- Capgo versions prior to 12.128.2
- Self-hosted Capgo deployments using the Enforce Password Policy feature
- Capgo organizations managed by Super Admin accounts
Discovery Timeline
- 2026-06-19 - CVE-2026-56080 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-56080
Vulnerability Analysis
The flaw is a business logic error in the Enforce Password Policy workflow. When a Super Admin enables the policy, Capgo marks the account as non-compliant until a compliant password is set. The user completes a valid password change to a policy-compliant value. The backend accepts the new password and stores it. However, the backend does not clear or update the password-compliance flag tied to the account. On the next authenticated request, the policy gate evaluates the stale flag and forces another password-reset prompt. Each subsequent password change repeats the same outcome. The account becomes trapped in a permanent reset loop, denying access to organization administration features.
Root Cause
The root cause is a missing state transition. The password-update handler does not write back the updated compliance status after validating that the new password meets policy requirements. The compliance check and the password storage operations are decoupled, and only one of them is updated during the workflow. This produces an inconsistency between the stored credential and its associated policy metadata.
Attack Vector
The condition is triggered by a legitimate administrative action rather than a remote attacker payload. Any Super Admin who enables Enforce Password Policy and then complies with the prompt will be locked out. Because organization recovery typically requires the Super Admin role, the lockout cascades into a broader denial-of-service condition for the affected organization. No exploit code or proof of concept is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is available. Refer to the GitHub Security Advisory GHSA-78rv-3cqj-36xq and the VulnCheck Authentication Flaw Advisory for upstream technical details.
Detection Methods for CVE-2026-56080
Indicators of Compromise
- Super Admin accounts repeatedly redirected to the password-reset workflow after submitting a policy-compliant password.
- Authentication logs showing multiple successful password updates for the same account within a short window.
- Helpdesk reports of Super Admin lockouts immediately after enabling Enforce Password Policy.
Detection Strategies
- Audit Capgo application logs for repeated password_change events tied to the same Super Admin identity.
- Correlate policy enable events with subsequent failed administrative actions to identify locked-out tenants.
- Compare deployed Capgo versions against 12.128.2 across self-hosted instances to flag exposed installations.
Monitoring Recommendations
- Track the password-compliance state field in the Capgo database for Super Admin records that remain non-compliant after a successful password update.
- Alert on Super Admin sessions that hit the password-reset endpoint more than once in a 24-hour period.
- Monitor administrative API endpoints for sustained 403 or redirect responses that indicate enforced policy gating loops.
How to Mitigate CVE-2026-56080
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later before enabling Enforce Password Policy.
- Defer enabling the Enforce Password Policy feature on any Capgo instance still running an affected version.
- Maintain a secondary administrative recovery path or break-glass account that can restore Super Admin access if a lockout occurs.
Patch Information
The fix is included in Capgo 12.128.2. The patched release updates the password-compliance state immediately after a policy-compliant password change, breaking the reset loop. Review the GitHub Security Advisory GHSA-78rv-3cqj-36xq for upstream commit references and validation notes.
Workarounds
- Keep Enforce Password Policy disabled until the upgrade to 12.128.2 is complete.
- If a Super Admin is already locked out, manually clear the password-compliance flag in the Capgo backend database for the affected account.
- Restrict who can toggle the Enforce Password Policy setting to reduce the chance of accidental activation on unpatched instances.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
