Cap-go before 12.128.12 suffers a broken cursor pagination flaw in the /private/devices endpoint served via Cloudflare/workerd. The flaw allows an authenticated user with app.read_devices rights to supply a non-advancing cursor filter that forces the paging mechanism into a duplicate-page loop, leaving subsequent rows unreachable and potentially causing repeated processing in device-management workflows. This weakness is a classic example of CWE-670, which deals with broken or missing pagination logic.

The affected system is the Cap-go application version prior to 12.128.12. Attackers need authenticated access to the /private/devices endpoint.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and possess app.read_devices privileges to exploit the flaw. The lack of an available running exploit does not preclude the abusive use of the feature for denial or disruption of device-listing operations.