Password Policy Vulnerability in Capgo by Capgo

CVE-2026-56228

What is CVE-2026-56228?

A serious vulnerability has been identified in Capgo, where the application fails to enforce a maximum limit on the minimum password length in its configuration settings. This allows organization administrators to set an impractically large numeric value for the minimum password length, which can reach billions of characters. As a result, once this flawed policy is activated, users, including administrators, will be unable to change their passwords or access their accounts, leading to widespread account lockouts across the organization and causing a denial of service at the application level. Immediate action is recommended to ensure that the application is updated to the latest version to mitigate this risk.

References