Capgo versions before 12.128.2 have a SQL injection vulnerability in the POST /private/admin_stats endpoint. The vulnerability arises because the limit parameter from the request body is not validated and is directly interpolated into SQL queries used by the Cloudflare Analytics Engine. This allows an attacker with platform admin credentials to inject SQL fragments, potentially enumerating dataset schemas, extracting analytics data, or causing denial-of-service against the analytics backend.