SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-56281

LOW · CVSS 3.8 EPSS 0.20% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-12 · Last synced 2026-08-11

CyberRota Analysis

AI-Generated

The vulnerability exists in Capgo versions prior to 12.128.2, specifically affecting the POST /private/admin_stats endpoint, where the limit parameter is improperly validated. This SQL injection flaw allows an authenticated attacker with admin credentials to manipulate SQL queries, potentially leading to unauthorized data extraction, enumeration of dataset schemas, or denial-of-service against the analytics backend. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure and service disruption.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56281
Severity
LOW
CVSS
3.8
EPSS
0.20%

Original NVD Description

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.