Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and is a denial of service issue. It allows attackers to register accounts using arbitrary email addresses without verifying ownership of those emails. After registering, attackers can initiate deletion of these accounts, which locks the associated email addresses in a pending deletion state.

By exploiting this flaw, attackers can cause legitimate users to be locked out of the platform for 30 days because their email addresses remain in this pending deletion state, preventing them from accessing or using their accounts.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service against legitimate users. Attackers can lock users out of their accounts for up to 30 days by exploiting the unverified email ownership process during account lifecycle operations.

This means that users will be unable to access their accounts or use the platform during this period, which could disrupt business operations, user experience, and trust in the platform.

Useful 0 Not Useful 0