The vulnerability in Capgo prior to version 12.128.2 is a SQL injection (CWE-89) in the POST /private/admin_stats endpoint. The limit parameter is destructured from the request body without validation and used directly in SQL queries via template literals. An attacker with platform admin privileges can exploit this to manipulate SQL queries, leading to unauthorized data access or denial-of-service conditions on the analytics backend. There is no indication of known exploits in the wild. The vulnerability is rated as moderate severity and no patch information is provided.

An attacker with platform admin credentials can exploit this vulnerability to enumerate dataset schemas, extract sensitive analytics data, or cause denial-of-service conditions against the analytics backend. This could lead to unauthorized disclosure of analytics information and disruption of analytics services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Restricting platform admin access and validating input parameters in the interim may reduce risk.