The vulnerability resides in Capgo before version 12.128.2 and allows administrators to configure webhooks whose URLs are not properly validated. This permits a server‑side request forgery that can target loopback and internal IP addresses. An attacker who can trigger the webhook can cause the Capgo backend to make outbound requests to localhost or 127.0.0.1, with the resulting error messages exposed to users. The flaw can lead to information disclosure and potential control of internal services.

Capgo core application, versions older than 12.128.2 are affected.

The CVSS base score is 5.3, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the adversary to be able to trigger a webhook, normally performed by an organization admin. Once triggered, the backend performs outbound HTTP requests to the supplied URL, which can reach internal hosts; the response body is returned to the user, allowing access to sensitive internal information. The lack of documented public exploitation suggests limited public use, but the flaw remains exploitable by privileged users within a Capgo deployment.