CVE-2026-56325

LowCVSS 3.1/10Last modified Jun 22, 2026

Description

Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character at underscore positions to cause unintended pattern matches, breaking preview functionality for legitimate apps or causing app-id confusion.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 20, 2026
Last modified
Jun 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-563266.1Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properlCVE-2026-563275.3Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticCVE-2026-563286.5Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requesCVE-2026-563296.4Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscorCVE-2026-56337.3A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. ExecCVE-2026-563303.5Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbacCVE-2026-563315.3Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx CVE-2026-563324.7Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbiCVE-2026-563334.3Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated orgCVE-2026-563344.3Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from pCVE-2026-563356.5Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel confiCVE-2026-563365.3Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that return
CVE-2026-56325: Low severity, CVSS 3.1 | Vulnix