CVE-2026-56325

Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup

View on CVE.org
Published Jun 20, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Description
Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character at underscore positions to cause unintended pattern matches, breaking preview functionality for legitimate apps or causing app-id confusion.

Analysis

AI-generated

Technical impact

Capgo prior to version 12.128.2 performs a wildcard comparison for the app_id during preview subdomain resolution, treating underscore characters as SQL wildcards. This flaw allows attackers to create application identifiers that differ from a legitimate app only by underscore placement, causing unintended matches. As a result, preview requests for one app can resolve to a different app or fail entirely, breaking preview functionality for users and potentially exposing sensitive data during preview sessions.

Affected Systems

The vulnerability affects the Capgo platform in all releases before 12.128.2. Users running any older Capgo instance are susceptible unless they have otherwise patched or custom‑modified the preview subdomain logic.

Risk and Exploitability

The CVSS score of 2.3 indicates a low severity flaw, and the EPSS score is not available, suggesting no known widespread exploitation. Attackers can exploit the issue remotely by creating an app with a crafted identifier that leverages wildcard matching to trigger unintended preview subdomain resolution. The flaw is not listed in the CISA KEV catalog, and no public exploits have been reported, but the functional impact on preview services warrants a patch as soon as possible.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Capgo to version 12.128.2 or later
  • If an upgrade is not immediately possible, modify the preview subdomain resolver to enforce exact equality comparison for app_id values, ensuring that underscore characters are treated literally
  • Validate all new app identifiers to exclude wildcard characters or enforce stricter naming rules

Generated by OpenCVE AI on June 20, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Cap-go
Cap-go cap-go
Vendors & Products Cap-go
Cap-go cap-go
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character at underscore positions to cause unintended pattern matches, breaking preview functionality for legitimate apps or causing app-id confusion.
Title Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-20

    Improper Input Validation

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 8, 2026, 2:06 PM
Reserved
Jun 20, 2026, 1:06 PM

View source JSON

Updated
Jun 22, 2026, 5:27 PM

JSON

Status
Deferred
Published
Jun 20, 2026, 4:17 PM
Modified
Jun 22, 2026, 7:17 PM

View source JSON

No data.

Updated
Jun 24, 2026, 8:15 PM

JSON