PT-2026-51148 · Cap Go · Cap-Go

Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56228

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description The software fails to enforce a maximum value on the minimum password length field within the password policy configuration. An authenticated organization administrator can set an excessively large numeric value for this field, making it impossible for organization members to comply with the password requirements. Once this policy is enabled, users and administrators are unable to change passwords or access the organization, leading to an organization-wide account lockout and an application-level denial of service (a condition where the application becomes unavailable to its intended users).

Recommendations Update to version 12.128.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-56228

Affected Products

Cap-Go

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-56228 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-vhjp-62qf-33mx · Vendor Advisory
• https://twitter.com/CVEnew/status/2068380912941727773 · Twitter Post
• https://twitter.com/infoflowcloud/status/2068382492361457897 · Twitter Post
• https://vulncheck.com/advisories/capgo-denial-of-service-via-improper-password-policy-length-validation · Note