CVE-2026-56281 | Capgo before 12.128.2 contains a sql injection vulnerability… | CVSS 3.8 LOW

Description

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.

Metadata

CVE ID: CVE-2026-56281
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-20 01:51 UTC
Published: 2026-07-12 12:06 UTC
Last updated: 2026-07-12 12:06 UTC
Primary CWE: CWE-89
Improper Neutralization of Special Elements used in an SQL C…
Vendor / Product: Capgo / Capgo
Sources: cve.org · NVD

Severity & Metrics

3.8 LOW CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L

Affected products (1)

Vendor	Product	Platform	Versions
Capgo	Capgo	—	0 < 12.128.2, 12.128.2

Weakness (CWE)

CWE	Source	Description
CWE-89	cna	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
5.1	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
3.8	LOW	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L

References (2)

GitHub Security Advisory (GHSA-6ffx-8hjj-jhhf) https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf
VulnCheck Advisory: Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint https://www.vulncheck.com/advisories/capgo-sql-injection-via-unvalidated-limit-parameter-in-admin-stats-endpoint