CyberRota Analysis
AI-GeneratedCapgo versions prior to 12.128.2 are vulnerable to a cross-tenant preview namespace collision due to improper decoding of underscores in hostname parsing. This flaw allows attackers to create app IDs that interfere with other tenants' app IDs, potentially leading to misrouting of previews and denial of access for affected applications. Organizations using Capgo should prioritize patching to mitigate the risk of unauthorized access and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim applications.