CyberRota Analysis
AI-GeneratedCapgo versions prior to 12.128.12 are vulnerable to a billing authorization bypass due to a flaw in the plan_valid calculation, enabling unauthorized access to critical endpoints even after usage credits are exhausted or expired. This vulnerability allows attackers to exploit discrepancies between the plugin's plan_valid expression and the billing gate, potentially leading to unauthorized data access. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access to sensitive functionalities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan_valid expression and the authoritative billing gate to gain continued access to /updates, /stats, /channel_self, and attachment upload endpoints after credit depletion.