Capgo EUVD-2026-38113

Exploitation requires a valid, authenticated Capgo account with the ability to register new applications (CVSS PR:L). The attacker must know or successfully infer the target application's app_id in order to craft a colliding identifier. Only applications using Capgo's preview subdomain feature are affected by this flaw; the description does not indicate that production subdomains or other routing mechanisms share the same vulnerable lookup path. High attack complexity (AC:H) reflects the need to precisely position underscore wildcard characters in the attacker-controlled app_id to achieve a match against the victim's identifier. Exploitation is constrained to disrupting preview availability for the targeted app; the CVSS vector (VC:N/VI:N) confirms no path to confidentiality or integrity compromise. Self-hosted Capgo deployments where the preview subdomain feature is disabled or not network-exposed are not at risk from external attackers.

The CVSS 4.0 base score of 2.3 (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) accurately represents a low-severity, narrowly scoped vulnerability. Real-world exploitation requires an authenticated Capgo account with application-registration capability, knowledge or inference of the target app's exact app_id, and deliberate construction of a colliding identifier - all reflected in PR:L and AC:H. Impact is bounded to low-severity availability disruption of the preview subdomain feature (VA:L) with no confidentiality or integrity compromise per the CVSS vector. Notably, the intelligence tags include 'Information Disclosure,' which is not reflected in the VC:N metric; this may indicate secondary leakage - for example, confirming app_id existence through collision behavior - but this is inferred rather than confirmed by the CVE description. No EPSS data was provided in the source intelligence. No active exploitation is confirmed (CISA KEV absent), and no public proof-of-concept exploit has been identified at time of analysis. This vulnerability is low priority for most organizations but warrants timely patching by Capgo operators due to the trivial upgrade path.

An authenticated Capgo user registers an application with an app_id such as 'orgXmyappXprod' where X represents any single character, which under ILIKE matching acts as a wildcard that resolves to the victim app 'org_myapp_prod' (using literal underscores). When the victim's preview subdomain request is processed, the resolver incorrectly matches the attacker's app instead of the legitimate one, disrupting preview routing for the target application. No public exploit code exists at time of analysis, but the attack is conceptually straightforward for any authenticated Capgo user with working knowledge of SQL LIKE wildcard semantics.