---
id: CVE-2026-56281
title: >-
  Capgo before 12.128.2 contains a sql injection vulnerability in the POST
  /private/admin_stats endpoint where the limit parameter is destructured from
  unvalidated request body and interpolated directly into Cloudflare Analytics
  Engine SQL…
summary: >-
  Capgo before 12.128.2 contains a sql injection vulnerability in the POST
  /private/admin_stats endpoint where the limit parameter is destructured from
  unvalidated request body and interpolated directly into Cloudflare Analytics
  Engine SQL…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-89
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
published: '2026-07-12'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T18:16:50.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56281'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/capgo-sql-injection-via-unvalidated-limit-parameter-in-admin-stats-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-13T14:20:26.186927Z'
epss: 0.00334
epssPercentile: 0.24006
ingestedAt: '2026-07-12T12:20:13.401Z'
---

## Overview

Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.