Skip to content
Cap-go Capgo vulnerabilities
-
cap-go capgo.app
capgo through 12.128.2 IDOR via PUT /app icon endpoint
CVE-2026-100626
5.3 Medium
-
cap-go capgo.app
Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
CVE-2026-100629
7.0 High
-
cap-go capgo.app
capgo.app before 12.128.12 Authentication Bypass via apikey
CVE-2026-100628
8.7 High
-
cap-go capgo.app
Capgo bundle promotion API channel RBAC deny override bypass
CVE-2026-100627
7.2 High
-
cap-go capgo.app
Capgo Build Upload Proxy Authorization Bypass via TUS Resource
CVE-2026-100625
8.7 High
-
cap-go capgo.app
Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
CVE-2026-100624
5.3 Medium
-
cap-go capgo.app
Capgo Authentication Bypass via Direct PostgREST org_users Table Write
CVE-2026-100623
8.7 High
-
cap-go capgo.app
capgo.app through 12.129.0 Cache Restoration of Deleted Bundles
CVE-2026-100622
8.7 High
-
cap-go capgo.app
capgo.app Content-Lock Bypass via r2-direct Bundle Mutation
CVE-2026-100621
5.3 Medium
-
cap-go @capgo/cli
Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
CVE-2026-100620
5.1 Medium
-
cap-go capgo.app
Capgo OTA Manifest Poisoning via app_versions.manifest Bypass
CVE-2026-100619
8.7 High
-
cap-go capgo.app
Capgo App Icon Update Privilege Escalation via Service-Role Worker
CVE-2026-100618
8.7 High
-
cap-go capgo.app
Cap-go capgo.app Authorization Bypass via channel_permission_overrides
CVE-2026-100617
8.7 High
-
cap-go capgo.app
capgo.app Authentication Bypass via PostgREST customer_id Mutation
CVE-2026-100616
7.0 High
-
cap-go capgo.app
Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
CVE-2026-100615
8.7 High
-
cap-go capgo.app
Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker
CVE-2026-100614
8.7 High
-
cap-go capgo.app
capgo.app Authorization Bypass via Stale Channel Permission Overrides
CVE-2026-100613
6.0 Medium
-
cap-go capgo.app
Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
CVE-2026-100612
8.6 High
-
cap-go capgo.app
Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list
CVE-2026-100611
7.1 High
-
cap-go capgo.app
Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
CVE-2026-88864
9.3 Critical
-
cap-go capgo.app
capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
CVE-2026-88863
8.6 High
-
cap-go capgo.app
Capgo API Key Manager Authentication Bypass via x-limited-key-id
CVE-2026-88862
8.7 High
-
cap-go capgo.app
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
CVE-2026-88861
Public exploit
8.7 High
-
cap-go capgo.app
Capgo Authorization Bypass via Stale Channel Permission Overrides
CVE-2026-88860
9.3 Critical
-
cap-go capgo
Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC
CVE-2026-56339
8.7 High
-
cap-go capgo
Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
CVE-2026-56336
6.9 Medium
-
cap-go capgo
Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
CVE-2026-56313
7.2 High
-
cap-go capgo
Capgo - Insufficient Authentication in Email Change Endpoint
CVE-2026-56308
8.4 High
-
cap-go capgo
Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
CVE-2026-56281
5.1 Medium
-
cap-go capgo
Capgo - Scope Isolation Failure in Webhook Test Endpoint
CVE-2026-56252
5.3 Medium
-
cap-go capgo
Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
CVE-2026-56241
7.2 High
-
cap-go capgo
Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint
CVE-2026-56238
8.7 High
-
cap-go capgo
Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function
CVE-2026-56303
8.7 High
-
cap-go capgo
Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC
CVE-2026-56296
6.9 Medium
-
cap-go capgo
Capgo - Billing Authorization Bypass via Exhausted Usage Credits
CVE-2026-56240
5.3 Medium
-
cap-go capgo
Capgo - Channel Configuration Mutation via Write-Scoped API Keys
CVE-2026-56335
7.1 High
-
cap-go capgo
Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding
CVE-2026-56329
5.3 Medium
-
cap-go capgo
Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
CVE-2026-56312
6.9 Medium
-
cap-go capgo
Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint
CVE-2026-56309
5.3 Medium
-
cap-go capgo
Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
CVE-2026-56305
8.7 High
-
cap-go capgo
Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
CVE-2026-56279
8.7 High
-
cap-go capgo
Capgo - EXIF Metadata Exposure in App Information Image Upload
CVE-2026-56298
5.3 Medium
-
cap-go capgo
Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()
CVE-2026-56293
5.3 Medium
-
cap-go capgo
Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC
CVE-2026-56284
6.9 Medium
-
cap-go capgo
Capgo - HTML Injection Leading to Open Redirection in Organization Settings
CVE-2026-56283
4.8 Medium
-
cap-go capgo
Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions
CVE-2026-56250
8.7 High
-
cap-go capgo
Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance
CVE-2026-56246
7.2 High
-
cap-go capgo
Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC
CVE-2026-56226
8.7 High
-
cap-go capgo
Capgo - Unauthorized Manifest Insertion via Read-Only Org Member
CVE-2026-56220
7.1 High
-
cap-go capgo
Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update
CVE-2026-56217
5.3 Medium
- Show olderLoading…