The vulnerability in Capgo prior to version 12.128.2 involves improper validation in the accept_invitation endpoint, where user accounts can be created before captcha validation is enforced. Attackers can exploit this by submitting POST requests with invalid captcha tokens, effectively bypassing captcha protections. This leads to the creation of unauthorized accounts and the burning of invite links. The issue is categorized under CWE-287 (Improper Authentication). There is no indication of known exploits in the wild or an available patch. The CVSS 4.0 vector provided is incomplete or invalid, and no vendor advisory or patch information is available.

Attackers can create unauthorized user accounts without passing captcha validation, potentially leading to abuse of invite links and unwanted account creation. This could result in resource exhaustion or abuse of the invitation system. There is no evidence of further privilege escalation or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional monitoring or rate limiting on the accept_invitation endpoint to detect and prevent abuse. Avoid relying solely on captcha validation for invitation acceptance.