Capgo (Capgo) - vulnerabilities (CVEs)

82 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-07-12. Vendor: Capgo.

CVEs of Capgo

• CVE-2026-56336 - CVSS 6.9 (medium), 2026-07-12: Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id…
• CVE-2026-56313 - CVSS 8.1 (high), 2026-07-12: Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to…
• CVE-2026-56308 - CVSS 8.4 (high), 2026-07-12: Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An…
• CVE-2026-56281 - CVSS 5.1 (medium), 2026-07-12: Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from…
• CVE-2026-56252 - CVSS 5.4 (medium), 2026-07-12: Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped…
• CVE-2026-56241 - CVSS 8.3 (high), 2026-07-12: Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and…
• CVE-2026-56238 - CVSS 8.7 (high), 2026-07-12: Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers…
• CVE-2026-56303 - CVSS 8.7 (high), 2026-07-11: Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable…
• CVE-2026-56240 - CVSS 5.3 (medium), 2026-07-11: Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired…
• CVE-2026-56335 - CVSS 7.1 (high), 2026-07-10: Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields…
• CVE-2026-56329 - CVSS 6.4 (medium), 2026-07-10: Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in…
• CVE-2026-56312 - CVSS 6.9 (medium), 2026-07-10: Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is…
• CVE-2026-56309 - CVSS 5.4 (medium), 2026-07-10: Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly…
• CVE-2026-56305 - CVSS 8.7 (high), 2026-07-10: Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without…
• CVE-2026-56279 - CVSS 8.7 (high), 2026-07-10: Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite…
• CVE-2026-56298 - CVSS 5.3 (medium), 2026-07-08: Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can…
• CVE-2026-56293 - CVSS 5.4 (medium), 2026-07-08: Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between…
• CVE-2026-56283 - CVSS 5.4 (medium), 2026-07-08: Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content.…
• CVE-2026-56250 - CVSS 8.7 (high), 2026-07-08: Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2…
• CVE-2026-56246 - CVSS 8.1 (high), 2026-07-08: Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its…
• CVE-2026-56220 - CVSS 7.1 (high), 2026-07-08: Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA…
• CVE-2026-56217 - CVSS 5.3 (medium), 2026-07-08: Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles…
• CVE-2026-56334 - CVSS 5.3 (medium), 2026-06-30: Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder…
• CVE-2026-56333 - CVSS 5.3 (medium), 2026-06-30: Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist…
• CVE-2026-56331 - CVSS 6.9 (medium), 2026-06-30: Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when…
• CVE-2026-56328 - CVSS 7.1 (high), 2026-06-30: Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without…
• CVE-2026-56327 - CVSS 6.9 (medium), 2026-06-30: Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to…
• CVE-2026-56320 - CVSS 7.1 (high), 2026-06-30: Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it…
• CVE-2026-56318 - CVSS 6.9 (medium), 2026-06-30: Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error…
• CVE-2026-56300 - CVSS 8.7 (high), 2026-06-30: Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and…
• CVE-2026-56286 - CVSS 8.1 (high), 2026-06-30: Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication…
• CVE-2026-56249 - CVSS 7.6 (high), 2026-06-30: Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing…
• CVE-2026-56247 - CVSS 8.8 (high), 2026-06-30: Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending…
• CVE-2026-56233 - CVSS 8.7 (high), 2026-06-30: Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass…
• CVE-2026-56230 - CVSS 8.8 (high), 2026-06-30: Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header…
• CVE-2026-56224 - CVSS 5.4 (medium), 2026-06-30: Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without…
• CVE-2026-56219 - CVSS 8.7 (high), 2026-06-30: Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to…
• CVE-2026-56338 - CVSS 6.9 (medium), 2026-06-24: Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication…
• CVE-2026-56337 - CVSS 6.9 (medium), 2026-06-24: Capgo before 12.128.2 contains an information disclosure vulnerability in the public.exist_app_v2 RPC function that allows unauthenticated attackers to…
• CVE-2026-56302 - CVSS 6.9 (medium), 2026-06-24: Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and…
• CVE-2026-56257 - CVSS 7.1 (high), 2026-06-24: Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain…
• CVE-2026-56256 - CVSS 7.1 (high), 2026-06-24: Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing…
• CVE-2026-56237 - CVSS 9.3 (critical), 2026-06-24: Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the…
• CVE-2026-56244 - CVSS 7.1 (high), 2026-06-24: Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the…
• CVE-2026-56232 - CVSS 8.8 (high), 2026-06-24: Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey…
• CVE-2026-56231 - CVSS 7.6 (high), 2026-06-24: Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId…
• CVE-2026-56223 - CVSS 9.3 (critical), 2026-06-24: Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary…
• CVE-2026-56322 - CVSS 8.7 (high), 2026-06-23: Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter…
• CVE-2026-56225 - CVSS 8.7 (high), 2026-06-23: Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with…
• CVE-2026-56222 - CVSS 8.6 (high), 2026-06-23: Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped…
• CVE-2026-56243 - CVSS 8.6 (high), 2026-06-23: Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header…
• CVE-2026-56234 - CVSS 6.9 (medium), 2026-06-23: Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable…
• CVE-2026-56324 - CVSS 8.8 (high), 2026-06-22: Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating…
• CVE-2026-56323 - CVSS 8.7 (high), 2026-06-22: Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to…
• CVE-2026-56321 - CVSS 6.9 (medium), 2026-06-22: Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id…
• CVE-2026-56314 - CVSS 7.1 (high), 2026-06-22: Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable.…
• CVE-2026-56311 - CVSS 6.9 (medium), 2026-06-22: Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthenticated attackers…
• CVE-2026-56306 - CVSS 6.4 (medium), 2026-06-22: Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting…
• CVE-2026-56255 - CVSS 5.3 (medium), 2026-06-22: Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to…
• CVE-2026-56299 - CVSS 6.9 (medium), 2026-06-21: Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger…
• CVE-2026-56253 - CVSS 8.7 (high), 2026-06-21: Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to…
• CVE-2026-56251 - CVSS 7 (high), 2026-06-21: Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to…
• CVE-2026-56239 - CVSS 7.6 (high), 2026-06-21: Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs…
• CVE-2026-56242 - CVSS 8.7 (high), 2026-06-21: Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API…
• CVE-2026-56229 - CVSS 7.1 (high), 2026-06-21: Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs…
• CVE-2026-56332 - CVSS 5.1 (medium), 2026-06-20: Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external…
• CVE-2026-56330 - CVSS 4.8 (medium), 2026-06-20: Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl,…
• CVE-2026-56319 - CVSS 5.3 (medium), 2026-06-20: Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to…
• CVE-2026-56295 - CVSS 6.3 (medium), 2026-06-20: Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the…
• CVE-2026-56282 - CVSS 6.9 (medium), 2026-06-20: Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL…
• CVE-2026-56228 - CVSS 6.9 (medium), 2026-06-20: Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated…
• CVE-2026-56227 - CVSS 5.4 (medium), 2026-06-20: Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization…
• CVE-2026-56218 - CVSS 6.9 (medium), 2026-06-20: Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can…
• CVE-2026-56325 - CVSS 3.1 (low), 2026-06-20: Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore…
• CVE-2026-56215 - CVSS 8.7 (high), 2026-06-20: Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint…
• CVE-2026-56216 - CVSS 8.8 (high), 2026-06-20: Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint…
• CVE-2026-56214 - CVSS 8.7 (high), 2026-06-20: Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows…
• CVE-2026-56213 - CVSS 6.9 (medium), 2026-06-20: Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC,…
• CVE-2026-56212 - CVSS 5.1 (medium), 2026-06-20: Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory…
• CVE-2026-56079 - CVSS 7.1 (high), 2026-06-19: Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other…
• CVE-2026-53868 - CVSS 8.7 (high), 2026-06-12: Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification,…
• CVE-2026-53867 - CVSS 5.3 (medium), 2026-06-12: Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned…