Cap-go versions prior to 12.128.12 contain a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path. Authenticated users with app.read_devices permission can exploit non-advancing cursor filters to trigger infinite pagination loops, causing duplicate-page loops and preventing traversal of later dataset rows. This disrupts device-management workflows by causing repeated processing and making some data unreachable. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The affected product is a cloud service, and the vendor manages remediation.

Exploitation allows authenticated attackers with read access to devices to cause infinite pagination loops that prevent access to later data rows and cause repeated processing in device-management workflows. This can disrupt normal operations relying on device data traversal but does not escalate privileges or cause direct data leakage according to the available information.

Since this is a cloud-hosted service, the vendor manages remediation server-side. A patch is available for the underlying software (Cap-go 12.128.12 and later). Users should verify with the vendor advisory that the service has been updated and no further action is required on their part.