CVE-2026-56325: Capgo Preview App-ID Wildcard Injection via ILIKE Pattern Matching

Technical summary

The vulnerability exists in Capgo's preview subdomain resolver, which uses SQL ILIKE pattern matching rather than exact string comparison when resolving app_id lookups. ILIKE in SQL treats underscore (_) as a single-character wildcard. An authenticated attacker can register application IDs that differ from legitimate apps only in positions where underscores are used, causing the pattern-matching logic to incorrectly resolve requests. For example, an app_id like 'my_app' could unintentionally match against patterns like 'myxapp' or vice versa. This violates the principle of precise identifier matching and creates conditions for request misrouting or denial of preview service availability.

Business impact

Organizations using Capgo for application preview and distribution workflows could experience service degradation when preview links fail to resolve correctly. While the CVSS score reflects low severity, the business impact centers on availability and user experience—preview URLs may become unreliable, frustrating development and QA teams during the crucial pre-release phase. Additionally, the potential for app-id confusion introduces a soft integrity concern: users might be uncertain whether they are previewing the intended application version, which could lead to testing against wrong builds or delays in release cycles.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability requires authentication (an attacker must have a Capgo account), and the impact is limited to preview subdomain resolution. Organizations running Capgo in production for app preview and distribution should verify their version and apply the patch. The vendors_products field in the advisory does not enumerate specific Capgo editions or deployment configurations, so administrators should treat all pre-12.128.2 installations as potentially vulnerable.

Exploitability

Exploitation requires a valid Capgo account (PR:L in the CVSS vector), making this an insider-threat or compromised-account scenario rather than an unauthenticated attack. The attacker must understand Capgo's app naming conventions and deliberately register confusingly similar app IDs to trigger wildcard matches. This is not a remotely exploitable vulnerability in the traditional sense; it demands active participation and knowledge of the target environment. Attack complexity is High (AC:H), reflecting the specific conditions and naming strategies required to cause meaningful disruption.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch replaces ILIKE pattern matching with exact string matching for app_id resolution, eliminating the wildcard behavior. Before upgrading, review your Capgo installation version and consult the vendor release notes to confirm compatibility with your deployment. No workarounds are documented; patching is the definitive remediation. If upgrade timing is constrained, consider restricting account creation or closely monitoring new app registrations for suspicious naming patterns.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. The patch modifies the preview subdomain resolver to perform exact matching instead of ILIKE pattern matching. Verify the patch version in your deployed instance using Capgo's version reporting tools or CLI commands. Test preview functionality in a staging environment before deploying to production to confirm the fix does not introduce regressions. Rolling updates are typically safe for this type of patch; consult Capgo's deployment documentation for your specific infrastructure.

Detection guidance

Monitor Capgo for unusual app_id registrations, particularly names that differ by a single character or contain multiple underscores in positions that might overlap with existing app names. Review access logs for preview subdomain requests that resolve to unexpected applications. Enable detailed logging of app_id lookups if available in your Capgo configuration. Implement alerts for app registrations that closely resemble established production app identifiers. Post-patch, confirm that preview resolution logs show exact matches rather than wildcard matches by inspecting request headers and resolver output.

Why prioritize this

Although the CVSS score is low (3.1), this vulnerability should be scheduled for timely patching because it affects preview workflows that are critical to development velocity. The requirement for authentication limits the threat surface, but the insidious nature of name-based confusion—where developers may not immediately realize they are previewing the wrong build—makes it worthy of attention. Prioritize patching in environments where Capgo supports frequent releases or where preview URL sharing across teams is common. For isolated or single-team Capgo deployments, prioritization can be lower but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects the network-accessible nature of the vulnerability (AV:N), high attack complexity (AC:H), requirement for valid authentication (PR:L), and impact limited to availability (A:L) with no confidentiality or integrity impact. The score correctly captures that exploitation is difficult, requires an insider or compromised account, and does not lead to data breach or system compromise. However, the CVSS vector does not fully capture the operational nuisance of development workflow disruption, which is why security teams should consider business context alongside the numerical score.

Frequently asked questions