Vulnerability record/PUBLISHED/Published Jun 20, 2026 15:21:57 UTC
CVE-2026-56325
Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character at underscore positions to cause unintended pattern matches, breaking preview functionality for legitimate apps or causing app-id confusion.
Base score2.3/ 10
SeverityLowCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityHighAC
Attack requirementsNoneAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 8, 2026 14:06:00 UTC
PublishedJun 20, 2026 15:21:57 UTC
ReservedJun 20, 2026 13:06:29 UTC
Credits
- Judel777