Skip to contentCap-go Capgo vulnerabilities
- cap-go capgoCapgo - Open Redirect via Unvalidated Stripe Billing URLsCVE-2026-563304.8 Medium
- cap-go capgoCapgo - App Existence Oracle via GET /statistics/app/:app_idCVE-2026-563195.3 Medium
- cap-go capgoCap-go - Broken Cursor Pagination in /private/devices EndpointCVE-2026-563075.3 Medium
- cap-go capgoCapgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API KeysCVE-2026-562955.3 Medium
- cap-go capgoCapgo - Information Disclosure via Unauthenticated /replication EndpointCVE-2026-562826.9 Medium
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC FunctionsCVE-2026-562356.9 Medium
- cap-go capgoCapgo - Denial of Service via Improper Password Policy Length ValidationCVE-2026-562286.9 Medium
- cap-go capgoCapgo - Server-Side Request Forgery via Webhook URL ValidationCVE-2026-562275.3 Medium
- cap-go capgoCapgo - EXIF Metadata Exposure via Image UploadCVE-2026-562186.9 Medium
- cap-go capgoCapgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain LookupCVE-2026-563252.3 Low
- cap-go capgoCapgo - Scope Escalation via API Key Creation in /functions/v1/apikeyCVE-2026-562168.7 High
- cap-go capgoCapgo - Account Merge via Poisoned public.users.email in SSO ProvisioningCVE-2026-562158.7 High
- cap-go capgoCapgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCCVE-2026-562148.7 High
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPCCVE-2026-562136.9 Medium
- cap-go capgoCapgo - Improper 2FA Enforcement Logic via Team Security SettingsCVE-2026-562125.1 Medium
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPCCVE-2026-560828.7 High
- cap-go capgoCap-go - Account Lockout via 2FA Misconfiguration on Unverified EmailCVE-2026-560819.3 Critical
- cap-go capgoCap-go - Authentication Logic Flaw in Enforce Password PolicyCVE-2026-560806.9 Medium
- cap-go capgoCapgo - Cross-Tenant Authorization Bypass via PostgREST Webhook AccessCVE-2026-560797.1 High
- cap-go capgoCap-go - OTP Bypass via Response Manipulation in Email VerificationCVE-2026-560739.3 Critical
- cap-go capgoCapgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and DeletionCVE-2026-538688.7 High
- cap-go capgoCapgo < 12.128.2 - Orphaned File Retention via Profile Image ReplacementCVE-2026-538675.3 Medium
- cap-go capgoCap-go Console < 12.28.2 Account Deletion DoS via Device Identifier AssociationCVE-2026-539827.1 High