SQL Injection in Capgo
CVE-2026-56281
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L.
EPSS exploit prediction
EPSS: 0.003 (24.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 24.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Capgo — versions 0, 12.128.2
Weakness classification (CWE)
References
- github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf (vendor-advisory)
- www.vulncheck.com/advisories/capgo-sql-injection-via-unvalidated-limit-paramete… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-56281?
- CVE-2026-56281 is a low-severity vulnerability in Capgo, classified under SQL Injection. CVSS score: 3.8/10. Published 2026-07-12.
- How severe is CVE-2026-56281?
- Low severity. CVSS v3 base score is 3.8 out of 10.