Capgo versions prior to 12.128.2 are vulnerable because the preview hostname parsing routine non‑bijectively translates a pair of underscores into a dot. This manipulation allows an attacker to register an application identifier containing double underscores that, when decoded, coincides with another tenant’s dotted identifier. The result is a namespace collision that routes preview requests to the wrong tenant or blocks access entirely for the victim. This flaw is identified as CWE‑436 and does not provide remote code execution or privacy exposure.

All Capgo deployments running any release older than 12.128.2 are affected, as the problematic parsing logic is present in every instance that accepts tenant‑supplied application identifiers.

The CVSS score of 5.3 classifies this issue as medium severity. The EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely reported attacks. Exploitation requires the ability to register a new application identifier with double underscores – typically tenant‑level access. Successful exploitation denies preview access for the target tenant but does not leak data or compromise the host. Therefore the overall risk remains moderate.