Capgo - vulnerabilities (CVEs)

83 CVEs in 2 products, 0 in the last 30 days, newest from 2026-07-12.

Products

• Capgo - 82 CVEs
• Cli - 1 CVEs

Newest CVEs of Capgo

• CVE-2026-56336 - CVSS 6.9 (medium), 2026-07-12: Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id…
• CVE-2026-56313 - CVSS 8.1 (high), 2026-07-12: Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to…
• CVE-2026-56308 - CVSS 8.4 (high), 2026-07-12: Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An…
• CVE-2026-56281 - CVSS 5.1 (medium), 2026-07-12: Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from…
• CVE-2026-56252 - CVSS 5.4 (medium), 2026-07-12: Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped…
• CVE-2026-56241 - CVSS 8.3 (high), 2026-07-12: Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and…
• CVE-2026-56238 - CVSS 8.7 (high), 2026-07-12: Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers…
• CVE-2026-56303 - CVSS 8.7 (high), 2026-07-11: Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable…
• CVE-2026-56240 - CVSS 5.3 (medium), 2026-07-11: Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired…
• CVE-2026-56335 - CVSS 7.1 (high), 2026-07-10: Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields…
• CVE-2026-56329 - CVSS 6.4 (medium), 2026-07-10: Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in…
• CVE-2026-56312 - CVSS 6.9 (medium), 2026-07-10: Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is…
• CVE-2026-56309 - CVSS 5.4 (medium), 2026-07-10: Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly…
• CVE-2026-56305 - CVSS 8.7 (high), 2026-07-10: Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without…
• CVE-2026-56279 - CVSS 8.7 (high), 2026-07-10: Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite…
• CVE-2026-56298 - CVSS 5.3 (medium), 2026-07-08: Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can…
• CVE-2026-56293 - CVSS 5.4 (medium), 2026-07-08: Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between…
• CVE-2026-56283 - CVSS 5.4 (medium), 2026-07-08: Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content.…
• CVE-2026-56246 - CVSS 8.1 (high), 2026-07-08: Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its…
• CVE-2026-56250 - CVSS 8.7 (high), 2026-07-08: Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2…
• CVE-2026-56220 - CVSS 7.1 (high), 2026-07-08: Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA…
• CVE-2026-56217 - CVSS 5.3 (medium), 2026-07-08: Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles…
• CVE-2026-56334 - CVSS 5.3 (medium), 2026-06-30: Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder…
• CVE-2026-56333 - CVSS 5.3 (medium), 2026-06-30: Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist…
• CVE-2026-56328 - CVSS 7.1 (high), 2026-06-30: Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without…
• CVE-2026-56331 - CVSS 6.9 (medium), 2026-06-30: Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when…
• CVE-2026-56327 - CVSS 6.9 (medium), 2026-06-30: Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to…
• CVE-2026-56320 - CVSS 7.1 (high), 2026-06-30: Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it…
• CVE-2026-56318 - CVSS 6.9 (medium), 2026-06-30: Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validate_password_compliance endpoint that returns different error…
• CVE-2026-56300 - CVSS 8.7 (high), 2026-06-30: Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and…