EUVD-2026-38113
GHSA-pw45-xmrx-x2w8
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires authenticated app registration and precise wildcard app_id construction (PR:L, AC:H); impact is limited to preview availability disruption with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character at underscore positions to cause unintended pattern matches, breaking preview functionality for legitimate apps or causing app-id confusion.
AnalysisAI
Preview subdomain resolution in Capgo before 12.128.2 is susceptible to app-id confusion because the resolver uses PostgreSQL's ILIKE operator - which treats underscores as single-character wildcards - instead of exact equality matching for app_id lookups. An authenticated attacker who can register a Capgo application can craft an app_id with strategically placed underscores that collide with a victim application's identifier, hijacking preview subdomain resolution and breaking preview functionality for the targeted app. No public exploit code exists and no active exploitation has been confirmed (KEV absent); the CVSS 4.0 score of 2.3 reflects genuinely low real-world risk constrained by high attack complexity, required authentication, and limited availability-only impact.
Technical ContextAI
The vulnerability originates in Capgo's preview subdomain resolver, which performs app_id lookups using PostgreSQL's ILIKE operator (case-insensitive LIKE pattern matching). Under SQL LIKE semantics, an underscore character (_) functions as a wildcard matching any single character, and a percent sign (%) matches any sequence of characters. Because app identifiers in Capgo commonly use underscores as word separators, passing these identifiers directly into an ILIKE expression - without escaping metacharacters - causes each underscore to behave as a positional wildcard rather than a literal character. The root cause is classified as CWE-20 (Improper Input Validation): user-supplied app_id values are not sanitized or escaped before being embedded in a pattern-matching SQL query. CPE data (cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*) confirms all Capgo releases prior to 12.128.2 carry this flaw. The correct fix is either replacing ILIKE with an exact equality operator (=) or escaping underscore and percent metacharacters in the input before constructing the pattern.
RemediationAI
The primary fix is upgrading to Capgo version 12.128.2 or later, which addresses the root cause by replacing ILIKE with exact equality matching for app_id lookups in the preview subdomain resolver. The vendor security advisory at https://github.com/Cap-go/capgo/security/advisories/GHSA-cw88-ch2j-8vqj and the corroborating VulnCheck advisory at https://www.vulncheck.com/advisories/capgo-app-id-confusion-via-ilike-wildcard-in-preview-subdomain-lookup both confirm patch availability at this version. If an immediate upgrade is not feasible, a compensating control is to enforce an app_id naming policy that prohibits underscore characters in all newly registered applications, which eliminates the wildcard collision surface; however, this approach would break existing apps that already use underscores in their identifiers and would require migrating those identifiers - a significant operational trade-off. No other workaround resolves the underlying SQL metacharacter issue without a code-level change.
Authentication bypass in Capgo before 12.128.2 lets remote unauthenticated attackers mint arbitrary API keys by tamperin
Cross-domain SSO account takeover in Capgo before 12.128.2 allows an attacker with enterprise org admin access and a mal
Account pre-registration hijack in Capgo before 12.128.2 lets a remote unauthenticated attacker claim an account under a
Authentication bypass in Capgo prior to version 12.128.2 lets attackers defeat email-based OTP verification by tampering
Rate-limit bypass in Capgo versions prior to 12.128.2 lets remote unauthenticated attackers flood the channel_self endpo
Cross-tenant data poisoning in Supabase Capgo before 12.128.2 allows remote unauthenticated attackers to corrupt billing
Server-side privilege escalation in Capgo before 12.128.2 lets authenticated users holding build permissions abuse a pat
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers query the /functions/v1/channel_se
Account takeover in Capgo before 12.128.2 stems from a password-change endpoint that omits current-password validation (
Information disclosure in Capgo (Capacitor live-update/OTA platform) before 12.128.2 lets unauthenticated callers abuse
Unauthenticated information disclosure in Capgo before 12.128.2 lets remote attackers read organization RBAC role bindin
Cross-tenant authorization bypass in Capgo before 12.128.2 lets authenticated users impersonate another tenant's limited
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today