What is CVE-2026-56281?

CVE-2026-56281 is a low-severity vulnerability in Capgo, classified under SQL Injection. CVSS score: 3.8/10. Published 2026-07-12.

How severe is CVE-2026-56281?

Low severity. CVSS v3 base score is 3.8 out of 10.

SQL Injection in Capgo

CVE-2026-56281

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.

Vulnerability class: SQL Injection

EPSS: 0.003 (25.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L.

Affected products

Capgo — versions 0, 12.128.2

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-56281?: CVE-2026-56281 is a low-severity vulnerability in Capgo, classified under SQL Injection. CVSS score: 3.8/10. Published 2026-07-12.
How severe is CVE-2026-56281?: Low severity. CVSS v3 base score is 3.8 out of 10.