CVE-2026-56307

Cap-go - Broken Cursor Pagination in /private/devices Endpoint

Published Jun 20, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.

Analysis

Technical impact

Cap-go before 12.128.12 suffers a broken cursor pagination flaw in the /private/devices endpoint served via Cloudflare/workerd. The flaw allows an authenticated user with app.read_devices rights to supply a non-advancing cursor filter that forces the paging mechanism into a duplicate-page loop, leaving subsequent rows unreachable and potentially causing repeated processing in device-management workflows. This weakness is a classic example of CWE-670, which deals with broken or missing pagination logic.

Affected Systems

The affected system is the Cap-go application version prior to 12.128.12. Attackers need authenticated access to the /private/devices endpoint.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and possess app.read_devices privileges to exploit the flaw. The lack of an available running exploit does not preclude the abusive use of the feature for denial or disruption of device-listing operations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cap-go

capgo

unaffected

Version	Status	Constraints
`0`	affected	< 12.128.12
`12.128.12`	unaffected	—

No data.

Vendor Product Versions

Cap-go

Version	Status	Scheme	Platform
`[0,12.128.12)`	affected	semver	—
`12.128.12`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Cap-go to version 12.128.12 or later to receive the fixed pagination logic.
If upgrading is not immediately possible, revoke app.read_devices permissions from users who do not need device-listing capabilities, or restrict access to the /private/devices endpoint.
Monitor application logs for repeated pagination requests and database lock patterns that indicate an ongoing loop.

Generated by OpenCVE AI on June 20, 2026 at 17:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.282% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Cap-go/capgo/security/advisories/GHSA-8p6w-x7jg-v4xq
https://www.vulncheck.com/advisories/cap-go-broken-cursor-pagination-in-private-devices-endpoint

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cap-go Cap-go cap-go
Vendors & Products		Cap-go Cap-go cap-go

Jun 22, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 20, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.
Title		Cap-go - Broken Cursor Pagination in /private/devices Endpoint
Weaknesses		CWE-670
References		https://github.com/Cap-go/capgo/security/advisories/GHSA-8p6w-x7jg-v4xq https://www.vulncheck.com/advisories/cap-go-broken-cursor-pagination-in-private-devices-endpoint
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`