CVE-2026-56228: Capgo Password Policy DoS Vulnerability

CVE-2026-56228 Overview

Capgo before version 12.128.2 contains an input validation flaw in its password policy configuration. The application fails to enforce a maximum value on the minimum password length field. An authenticated organization administrator can set an arbitrarily large numeric value, such as billions of characters, as the minimum password length. Once the policy is enabled, no user can satisfy the requirement. Organization members, including administrators, lose the ability to change passwords or access the organization. The result is an organization-wide account lockout and an application-level denial of service. The flaw is tracked under [CWE-20] Improper Input Validation.

Critical Impact
A single misconfiguration by an organization administrator produces a persistent, organization-wide denial of service with no self-service recovery path for affected users.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo deployments using the password policy feature
Capgo organizations with administrator-configurable authentication settings

Discovery Timeline

2026-06-20 - CVE-2026-56228 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56228

Vulnerability Analysis

The vulnerability resides in the password policy configuration handler within Capgo. The application accepts the minimum password length field from an authenticated administrator without enforcing an upper bound. Numeric inputs in the range of billions of characters are accepted and persisted. Once the policy is saved and activated, every subsequent password validation routine compares user-supplied passwords against the impossible threshold and rejects them.

Because the policy applies to password changes and authentication flows, no organization member can rotate credentials or recover access. Administrators themselves are subject to the same policy and cannot reverse the configuration through the standard user interface. The blast radius is confined to a single tenant but persists until manual database intervention or a vendor-supplied fix is applied.

Root Cause

The root cause is missing server-side bounds checking on the password policy length parameter. The application trusts the administrator-supplied integer and writes it directly to the policy store. No sanity check restricts the value to a realistic range, such as 8 to 128 characters.

Attack Vector

Exploitation requires high privileges. An authenticated organization administrator submits a crafted policy update over the network containing an oversized integer for the minimum length field. No user interaction beyond the administrator action is needed. The attack succeeds whether triggered maliciously by a rogue insider, by an attacker who has compromised administrator credentials, or accidentally through user error.

The vulnerability does not affect confidentiality or integrity. Availability of the affected organization is the sole impact, but recovery requires out-of-band intervention.

Detection Methods for CVE-2026-56228

Indicators of Compromise

Password policy records containing minimum-length values significantly outside expected ranges, such as values exceeding 1,024.
Sudden spikes in failed password change attempts across an organization, with error messages referencing length requirements.
Authentication logs showing every member of an organization failing password validation simultaneously.
Administrator audit entries showing recent updates to the password policy configuration endpoint.

Detection Strategies

Query the application database or configuration store for password policy entries where min_length exceeds a defined sane ceiling.
Alert on administrative API calls that modify password policy parameters, especially when accompanied by unusually large numeric payloads.
Correlate password change failures across distinct user accounts within the same organization to identify systemic lockouts.

Monitoring Recommendations

Capture and retain audit logs for all changes to authentication and password policy configuration endpoints.
Establish a baseline for normal password policy values and trigger alerts on deviations.
Monitor help-desk ticket volume for password reset requests as a leading indicator of widespread lockout.

How to Mitigate CVE-2026-56228

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which enforces a maximum value on the minimum password length field.
Audit existing password policy records for unrealistic length values and correct them through direct database access if administrators are locked out.
Restrict the set of accounts authorized to modify organization-level authentication policy.
Review administrator audit logs for any recent policy modifications that could indicate exploitation or misconfiguration.

Patch Information

The vendor has released a fix in Capgo 12.128.2. The patch enforces a server-side maximum on the minimum password length configuration field. Refer to the GitHub Security Advisory GHSA-vhjp-62qf-33mx and the VulnCheck Advisory on DoS for technical details.

Workarounds

Apply schema-level constraints on the password policy table to cap the minimum length column at a realistic value such as 128.
Implement a proxy or web application firewall rule that rejects password policy update requests carrying length values above a defined threshold.
Maintain an out-of-band administrative recovery procedure that allows direct database edits to reset a misconfigured policy.
Limit administrator privileges using role separation so that policy changes require review or multi-party approval.

bash

# Example database-level constraint to cap policy values
ALTER TABLE password_policies
  ADD CONSTRAINT chk_min_length_range
  CHECK (min_length BETWEEN 8 AND 128);