Skip to content
Capgo vulnerabilities
Newest
-
cap-go capgo
Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
CVE-2026-56336
6.9 Medium
-
cap-go capgo
Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
CVE-2026-56313
7.2 High
-
cap-go capgo
Capgo - Insufficient Authentication in Email Change Endpoint
CVE-2026-56308
8.4 High
-
cap-go capgo
Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
CVE-2026-56281
5.1 Medium
-
cap-go capgo
Capgo - Scope Isolation Failure in Webhook Test Endpoint
CVE-2026-56252
5.3 Medium
-
cap-go capgo
Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
CVE-2026-56241
7.2 High
-
cap-go capgo
Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint
CVE-2026-56238
8.7 High
-
cap-go capgo
Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function
CVE-2026-56303
8.7 High
-
cap-go capgo
Capgo - Billing Authorization Bypass via Exhausted Usage Credits
CVE-2026-56240
5.3 Medium
-
cap-go capgo
Capgo - Channel Configuration Mutation via Write-Scoped API Keys
CVE-2026-56335
7.1 High
-
cap-go capgo
Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding
CVE-2026-56329
5.3 Medium
-
cap-go capgo
Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint
CVE-2026-56312
6.9 Medium
-
cap-go capgo
Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint
CVE-2026-56309
5.3 Medium
-
cap-go capgo
Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
CVE-2026-56305
8.7 High
-
cap-go capgo
Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint
CVE-2026-56279
8.7 High
-
cap-go capgo
Capgo - EXIF Metadata Exposure in App Information Image Upload
CVE-2026-56298
5.3 Medium
-
cap-go capgo
Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()
CVE-2026-56293
5.3 Medium
-
cap-go capgo
Capgo - HTML Injection Leading to Open Redirection in Organization Settings
CVE-2026-56283
4.8 Medium
-
cap-go capgo
Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions
CVE-2026-56250
8.7 High
-
cap-go capgo
Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance
CVE-2026-56246
7.2 High
-
cap-go capgo
Capgo - Unauthorized Manifest Insertion via Read-Only Org Member
CVE-2026-56220
7.1 High
-
cap-go capgo
Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update
CVE-2026-56217
5.3 Medium
-
cap-go capgo
Capgo - Missing UPDATE RLS Policy for Build Status Persistence
CVE-2026-56334
5.3 Medium
-
cap-go capgo
Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates
CVE-2026-56333
5.3 Medium
-
cap-go capgo
Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String
CVE-2026-56331
6.9 Medium
-
cap-go capgo
Capgo - Integrity Issue in Release Routing via Multiple Public Channels
CVE-2026-56328
7.1 High
-
cap-go capgo
Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC
CVE-2026-56327
6.9 Medium
-
cap-go capgo
Capgo - Org/App Scope Mismatch in Device Creation Endpoint
CVE-2026-56320
7.1 High
-
cap-go capgo
Capgo - Information Disclosure via /private/validate_password_compliance Endpoint
CVE-2026-56318
6.9 Medium
-
cap-go capgo
Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions
CVE-2026-56300
8.7 High
-
cap-go capgo
Capgo - Account Deletion Without Password Confirmation
CVE-2026-56286
7.0 High
-
cap-go capgo
Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision
CVE-2026-56249
7.2 High
-
cap-go capgo
Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment
CVE-2026-56247
8.7 High
-
cap-go capgo
Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy
CVE-2026-56233
8.7 High
-
cap-go capgo
Capgo - Broken Object Level Authorization via x-limited-key-id Header
CVE-2026-56230
8.7 High
-
cap-go capgo
Capgo - Login CSRF and Session Fixation via URL Query Parameters
CVE-2026-56224
5.1 Medium
-
cap-go capgo
Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass
CVE-2026-56219
8.7 High
-
cap-go capgo
Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint
CVE-2026-56338
6.9 Medium
-
cap-go capgo
Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2
CVE-2026-56337
6.9 Medium
-
cap-go capgo
Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security
CVE-2026-56302
6.9 Medium
-
cap-go capgo
Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update
CVE-2026-56257
7.1 High
-
cap-go capgo
Capgo - Two-Factor Authentication Bypass via Organization Management API
CVE-2026-56256
7.1 High
-
cap-go capgo
Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key
CVE-2026-56244
7.1 High
-
cap-go capgo
Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation
CVE-2026-56237
9.3 Critical
-
cap-go capgo
Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header
CVE-2026-56232
8.7 High
-
cap-go capgo
Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter
CVE-2026-56231
7.2 High
-
cap-go capgo
Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
CVE-2026-56223
9.3 Critical
-
cap-go capgo
Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter
CVE-2026-56322
8.7 High
-
cap-go capgo
Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
CVE-2026-56243
8.6 High
-
cap-go capgo
Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint
CVE-2026-56234
6.9 Medium
- Show olderLoading…