The vulnerability in Capgo prior to version 12.128.12 involves a billing authorization bypass due to a flaw in the plan_valid calculation. This discrepancy enables users whose usage credits are exhausted or expired to bypass billing enforcement mechanisms. The exploit leverages the divergence between the plugin's hot-path plan_valid expression and the authoritative billing gate, allowing continued access to specific API endpoints related to updates, statistics, channel information, and attachment uploads. The issue is categorized under CWE-285 (Improper Authorization). There is no indication of known exploits in the wild or available patches at this time.

Organizations using affected Capgo versions may experience unauthorized continued access to billing-gated endpoints after their usage credits have been depleted or expired. This could lead to unauthorized usage of services without proper billing, potentially causing financial loss or service abuse. The affected endpoints include /updates, /stats, /channel_self, and attachment upload functionalities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor for unusual usage patterns and consider implementing additional access controls or manual billing enforcement as a temporary measure.