Capgo before version 12.128.2 contains a flaw where the limit parameter of the POST /private/admin_stats endpoint is taken directly from an unvalidated request body and interpolated into Cloudflare Analytics Engine SQL queries via template literals. An attacker who holds platform administrator credentials can inject arbitrary SQL fragments, allowing enumeration of database schemas, extraction of sensitive analytics data, or execution of heavy queries that may cause a denial of service against the analytics backend. The vulnerability is a classic SQL injection scenario with no input validation or parameterization.

Any deployment of Capgo that has not been updated to 12.128.2 or later is vulnerable. The endpoint is only accessible to platform administrators, so the threat is limited to users with admin rights; non‑admin users are not directly affected by this flaw.

The CVSS score of 5.1 classifies the vulnerability as moderate. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. However, the requirement of administrative privileges reduces the potential attacker pool but still permits significant data exposure or service disruption. Given the moderate severity and the possibility of data theft or denial of service, timely remediation is recommended.