CVE-2026-56228— Capgo 输入验证错误漏洞

Capgo - Denial of Service via Improper Password Policy Length Validation

Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimum password length, making compliance impossible for all organization members. Once the policy is enabled, users (including administrators) are unable to change their passwords or access the organization, resulting in an organization-wide account lockout and application-level denial of service.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

输入验证不恰当

Capgo 输入验证错误漏洞

Capgo是CAPGO公司的一个专为CapacitorJS开发者打造的移动应用开发和更新平台。 Capgo 12.128.2之前版本存在输入验证错误漏洞，该漏洞源于输入验证错误，未能对密码策略配置中的最小密码长度字段进行最大值限制，可能导致经身份验证的组织管理员设置极大数值，导致组织范围内账户锁定和应用程序级拒绝服务。

N/A

N/A