EUVD-2026-43229
GHSA-p2w3-hw46-3q2w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credential requirement drives PR:H; impacts are partial analytics read and backend disruption only, so C:L, I:N, A:L; scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.
AnalysisAI
SQL injection in Capgo's POST /private/admin_stats endpoint allows platform administrators to inject arbitrary SQL fragments into Cloudflare Analytics Engine queries via an unsanitized limit parameter. Affected versions are all Capgo releases before 12.128.2. An attacker holding valid platform admin credentials can exploit this to enumerate analytics dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend. No public exploit has been identified at time of analysis, and the high-privilege requirement (PR:H) substantially limits realistic blast radius.
Technical ContextAI
Capgo is an open-source live-update platform for Capacitor-based mobile applications. The vulnerable code path is in the backend admin API: the POST /private/admin_stats route destructures the limit parameter directly from the raw, unvalidated request body and interpolates it into a Cloudflare Analytics Engine SQL query string using JavaScript template literals - a classic CWE-89 (Improper Neutralization of Special Elements in an SQL Command) pattern. Cloudflare Analytics Engine exposes a SQL-like query interface, and because no parameterization or allowlist validation is applied to limit before string concatenation, an attacker can inject SQL keywords, subqueries, or destructive clauses. The affected CPE is cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, covering all versions prior to 12.128.2.
RemediationAI
Upgrade Capgo to version 12.128.2 or later, which resolves the SQL injection by applying proper input validation or parameterization to the limit parameter before it reaches the Analytics Engine query. The fix is detailed in the vendor advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf. If immediate upgrade is not feasible, apply a WAF or API gateway rule on the POST /private/admin_stats route that enforces the limit parameter as a strictly numeric integer (e.g., regex ^[0-9]+$) and rejects any non-conforming value - this eliminates the injection surface with minimal functional impact. Additionally, restrict access to all /private/admin_stats requests to known administrative IP ranges, reducing the attack surface to trusted network segments. Note that the WAF approach is a compensating control only and does not eliminate the underlying CWE-89 flaw in the application code.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today