Executive brief
Capgo, a tool for managing app updates, contains a security flaw in its administrative statistics dashboard. An authorized administrator could send a specially crafted request to the analytics system to view internal database structures or disrupt the analytics service. While this requires administrative access, it could allow a malicious insider or someone with stolen credentials to access data they are not supposed to see or cause a service outage.
Technical details
A SQL injection vulnerability exists in Capgo's `admin_stats.ts` backend function. The application uses a Zod schema to validate certain request body parameters but fails to include the `limit` and `offset` parameters in the validation logic. These unvalidated parameters are destructured directly from the raw request body and interpolated into raw SQL strings using JavaScript template literals within the Cloudflare Analytics Engine utility. An attacker with platform admin credentials can exploit this to inject SQL fragments, allowing for dataset schema enumeration, unauthorized data extraction, or denial-of-service attacks against the analytics backend. The issue is resolved in version 12.128.2 by including all parameters in the Zod validation schema.
Affected products
- Capgo Capgo < 12.128.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-07-12: disclosed: CVE published to NVD