CVE-2026-56325: Capgo SQL Injection Vulnerability

CVE-2026-56325 Overview

Capgo versions prior to 12.128.2 contain an input validation flaw in the preview subdomain resolver. The application uses PostgreSQL ILIKE pattern matching instead of exact string comparison when looking up app_id values. Because the underscore character (_) functions as a single-character wildcard in SQL LIKE and ILIKE expressions, attackers can register apps with app_id values that differ by one character at underscore positions. This produces unintended pattern matches that break preview functionality for legitimate apps or cause app-id confusion in the preview subdomain routing layer. The issue is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Authenticated attackers can collide with legitimate app_id values to disrupt preview routing and induce app identity confusion in the Capgo platform.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Preview subdomain resolver component within Capgo
Self-hosted and managed Capgo deployments running affected versions

Discovery Timeline

2026-06-20 - CVE-2026-56325 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56325

Vulnerability Analysis

The vulnerability resides in Capgo's preview subdomain lookup logic. When a request arrives at a preview subdomain, the resolver queries the database for a matching app_id. Instead of using an equality operator, the query uses PostgreSQL's ILIKE operator. ILIKE performs case-insensitive pattern matching and interprets _ as a wildcard that matches exactly one character. Many legitimate app_id values in Capgo follow reverse-DNS style naming such as com.example.app, where periods and underscores are common. Attackers can register an app whose app_id differs from a target by exactly one character at the position of an underscore. The malicious app_id then matches the target during preview lookups, breaking the intended one-to-one mapping between subdomain identifiers and applications.

Root Cause

The root cause is the use of ILIKE for an operation that requires exact, case-sensitive matching. The developer did not escape SQL wildcard metacharacters (_ and %) embedded in user-controlled app_id strings. This conflates pattern matching with identity lookup, a classic improper input validation issue under [CWE-20].

Attack Vector

Exploitation requires an authenticated account capable of creating Capgo apps. The attacker registers an app_id that mirrors a victim app_id but substitutes any single character at an underscore position. When a request resolves a preview subdomain associated with either app, the ILIKE predicate returns multiple rows, producing nondeterministic routing or failure. The attack does not yield code execution or data exfiltration. The impact is limited to availability of preview functionality and identity integrity within the subdomain resolver. Refer to the GitHub Security Advisory GHSA-cw88-ch2j-8vqj and the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2026-56325

Indicators of Compromise

Multiple Capgo apps with app_id values that differ by a single character at underscore positions
Preview subdomain requests resolving to unexpected or inconsistent applications
Database query logs showing ILIKE predicates against the app_id column returning more than one row

Detection Strategies

Audit the Capgo apps table for app_id collisions when underscores are interpreted as wildcards using a query such as SELECT a.app_id, b.app_id FROM apps a JOIN apps b ON a.app_id ILIKE b.app_id AND a.app_id <> b.app_id.
Review application logs from the preview subdomain resolver for lookups returning ambiguous matches or routing inconsistencies.
Inspect recent app registrations for app_id patterns that closely shadow established applications.

Monitoring Recommendations

Alert on creation of new app_id values that match existing identifiers under wildcard expansion of _.
Track HTTP 4xx/5xx error rates on preview subdomains, which may indicate ambiguous routing caused by colliding identifiers.
Log and review all SQL queries against app_id lookup paths to confirm exact-match semantics post-patch.

How to Mitigate CVE-2026-56325

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which replaces ILIKE with exact matching in the preview subdomain resolver.
Enumerate existing app_id records and identify any wildcard collisions before patching to preserve legitimate ownership.
Restrict app creation to trusted accounts until the upgrade is complete.

Patch Information

Upgrade to Capgo 12.128.2 or later. The fix changes the app_id lookup in the preview subdomain resolver to use exact equality instead of ILIKE, eliminating SQL wildcard interpretation of the _ character. See the GitHub Security Advisory GHSA-cw88-ch2j-8vqj for the patch commit details.

Workarounds

Reject or sanitize app_id values containing _ or % at registration time if immediate upgrade is not possible.
Add a uniqueness constraint enforced under wildcard expansion to prevent registration of colliding identifiers.
Temporarily disable preview subdomain functionality until the patched version is deployed.

bash

# Configuration example - upgrade Capgo to the patched release
npm install @capgo/capgo@^12.128.2
# or, for self-hosted deployments using the published container image
docker pull capgo/capgo:12.128.2
docker compose up -d capgo