Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56325Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup

Low 3.1

In plain English

A low-severity improper input validation in Capgo from Capgo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one character at underscore positions to cause unintended pattern matches, breaking preview functionality for legitimate apps or causing app-id confusion.

Affected products (as reported)

Vendor	Product	Versions
Capgo	Capgo	0 – before 12.128.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

GHSA Advisory GHSA-cw88-ch2j-8vqj vendor-advisory
VulnCheck Advisory: Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup third-party-advisory