CVE-2026-56281: Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/adminstats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56281?
The severity of CVE-2026-56281 is rated as low, with a score of 3.8.
How do I fix CVE-2026-56281?
To fix CVE-2026-56281, update Capgo to version 12.128.2 or later, ensuring that limit parameters are properly validated before use.
What type of vulnerability is CVE-2026-56281?
CVE-2026-56281 is classified as an SQL Injection vulnerability due to unvalidated input in the admin stats endpoint.
Which endpoint is affected by CVE-2026-56281?
The affected endpoint in CVE-2026-56281 is the POST /private/admin_stats endpoint.
What impact does CVE-2026-56281 have on the system?
CVE-2026-56281 allows an attacker with administrative access to potentially manipulate SQL queries, leading to unauthorized data access.