Capgo EUVD-2026-38364

Attacker must hold a valid Capgo API key with at least read-level permissions and reach the analytics endpoints backed by cloudflare.ts (which proxy queries to Cloudflare Analytics Engine); the vulnerable parameters are deviceIds, search, version_name, cursor, and actions in the API request body, and only Capgo deployments running a version before 12.128.2 are affected. No user interaction is required and the vector is network-reachable, but exploitation is limited to reading analytics data - there is no integrity or availability impact (VI:N/VA:N), and single-tenant self-hosted Capgo installs have no meaningful cross-tenant target.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) with score 7.1 is consistent with the description: network-reachable API, low complexity, low privileges (a read-level API key), no user interaction, and a high confidentiality impact bounded to analytics data with no integrity or availability effect. The realistic risk is moderate rather than critical because exploitation requires a valid API key - any unauthenticated path is not implied - and impact is limited to analytics records rather than full database compromise. EPSS and CISA KEV signals are not provided in the input, and no public PoC is referenced, so this should be treated as a known-but-not-yet-actively-exploited cross-tenant disclosure issue. SaaS operators of Capgo and self-hosters with multi-tenant deployments should treat it as higher priority than a single-tenant self-host, where the blast radius is effectively self-targeting.

An attacker registers or compromises a Capgo account, obtains a read-level API key, and issues an analytics request whose deviceIds or search field contains a SQL fragment such as a UNION or boolean tautology that breaks out of the intended tenant-scoped WHERE clause. The Cloudflare Analytics Engine then returns analytics rows belonging to other applications or users, which the attacker exfiltrates iteratively across the five injectable parameters.