Cap-go Capgo.app vulnerabilities

• cap-go capgo.app capgo through 12.128.2 IDOR via PUT /app icon endpoint CVE-2026-100626 5.3 MediumSeptember 26, 2026
• cap-go capgo.app Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH CVE-2026-100629 7.0 HighSeptember 26, 2026
• cap-go capgo.app capgo.app before 12.128.12 Authentication Bypass via apikey CVE-2026-100628 8.7 HighSeptember 26, 2026
• cap-go capgo.app Capgo bundle promotion API channel RBAC deny override bypass CVE-2026-100627 7.2 HighSeptember 26, 2026
• cap-go capgo.app Capgo Build Upload Proxy Authorization Bypass via TUS Resource CVE-2026-100625 8.7 HighSeptember 26, 2026
• cap-go capgo.app Capgo.app before 12.264.5 Upload Expiry Bypass via build upload CVE-2026-100624 5.3 MediumSeptember 26, 2026
• cap-go capgo.app Capgo Authentication Bypass via Direct PostgREST org_users Table Write CVE-2026-100623 8.7 HighSeptember 26, 2026
• cap-go capgo.app capgo.app through 12.129.0 Cache Restoration of Deleted Bundles CVE-2026-100622 8.7 HighSeptember 26, 2026
• cap-go capgo.app capgo.app Content-Lock Bypass via r2-direct Bundle Mutation CVE-2026-100621 5.3 MediumSeptember 26, 2026
• cap-go capgo.app Capgo OTA Manifest Poisoning via app_versions.manifest Bypass CVE-2026-100619 8.7 HighSeptember 26, 2026
• cap-go capgo.app Capgo App Icon Update Privilege Escalation via Service-Role Worker CVE-2026-100618 8.7 HighSeptember 26, 2026
• cap-go capgo.app Cap-go capgo.app Authorization Bypass via channel_permission_overrides CVE-2026-100617 8.7 HighSeptember 26, 2026
• cap-go capgo.app capgo.app Authentication Bypass via PostgREST customer_id Mutation CVE-2026-100616 7.0 HighSeptember 26, 2026
• cap-go capgo.app Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation CVE-2026-100615 8.7 HighSeptember 26, 2026
• cap-go capgo.app Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker CVE-2026-100614 8.7 HighSeptember 26, 2026
• cap-go capgo.app capgo.app Authorization Bypass via Stale Channel Permission Overrides CVE-2026-100613 6.0 MediumSeptember 26, 2026
• cap-go capgo.app Capgo SSO Provider ID Authentication Bypass via Incomplete Migration CVE-2026-100612 8.6 HighSeptember 26, 2026
• cap-go capgo.app Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list CVE-2026-100611 7.1 HighSeptember 26, 2026
• cap-go capgo.app Capgo SSO Provider Authentication Bypass via PostgREST Direct Write CVE-2026-88864 9.3 CriticalSeptember 10, 2026
• cap-go capgo.app capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org CVE-2026-88863 8.6 HighSeptember 10, 2026
• cap-go capgo.app Capgo API Key Manager Authentication Bypass via x-limited-key-id CVE-2026-88862 8.7 HighSeptember 10, 2026
• cap-go capgo.app Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization CVE-2026-88861 Public exploit 8.7 HighSeptember 10, 2026
• cap-go capgo.app Capgo Authorization Bypass via Stale Channel Permission Overrides CVE-2026-88860 9.3 CriticalSeptember 10, 2026