---
id: CVE-2026-56307
title: Cap-go - Broken Cursor Pagination in /private/devices Endpoint
summary: >-
  Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in
  the /private/devices endpoint on the Cloudflare/workerd path that allows
  authenticated attackers to cause duplicate-page loops and make later rows
  unreachable. …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-670
vendor: Cap-go
product: capgo
affected:
  - capgo < 12.128.12
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-22T17:26:18.732131Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:57.275Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56307'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-8p6w-x7jg-v4xq'
    label: GitHub Security Advisory (GHSA-8p6w-x7jg-v4xq)
  - url: >-
      https://www.vulncheck.com/advisories/cap-go-broken-cursor-pagination-in-private-devices-endpoint
    label: >-
      VulnCheck Advisory: Cap-go - Broken Cursor Pagination in /private/devices
      Endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00282
epssPercentile: 0.20805
ingestedAt: '2026-11-08T14:51:22.359Z'
---

## Overview

Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.

## Affected

- `capgo < 12.128.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.