Cap-go versions before 12.128.2 contain multiple SQL injection vulnerabilities in the cloudflare.ts component. These vulnerabilities arise because user-controlled values from API request bodies are directly embedded into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can exploit this by injecting SQL through parameters including deviceIds, search, version_name, cursor, and actions. This allows unauthorized access to analytics data belonging to other users or applications. The vulnerability has a CVSS 4.0 score of 7.1 (high severity). The product is cloud-hosted, and a patch is available, though the vendor advisory does not specify remediation details.

Successful exploitation allows authenticated users with limited read-level API permissions to perform SQL injection attacks, potentially accessing or extracting analytics data of other users or applications beyond their authorization. This compromises data confidentiality and could lead to unauthorized data disclosure within the cloud service environment.

Since capgo is a cloud-hosted service and a patch is available, remediation is managed by the vendor. Users should verify with the vendor advisory that the service has been updated to version 12.128.2 or later. No additional mitigation actions are specified. Patch status is confirmed as available but details should be confirmed from the vendor advisory.