What’s Vulnerable › Vulnerabilities

CVE-2026-56281: Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint

• Severity: low (CVSS 3.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-12 · updated 2026-09-17
• Weakness: CWE-89

Description

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf
• https://www.vulncheck.com/advisories/capgo-sql-injection-via-unvalidated-limit-parameter-in-admin-stats-endpoint
• https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf

Get alerted when CVE-2026-56281 or the next vulnerability affects your stack