Skip to contentCapgo vulnerabilities
Newest
- cap-go capgoCapgo - Authorization Bypass in API Key Management via App-Limited KeysCVE-2026-562258.7 High
- cap-go capgoCapgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindingsCVE-2026-562228.6 High
- cap-go capgoCapgo - Rate Limit Bypass via User-Controlled device_id ParameterCVE-2026-563248.8 High
- cap-go capgoCapgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_selfCVE-2026-563238.7 High
- cap-go capgoCapgo - Missing Authentication Middleware on GET /private/role_bindings EndpointCVE-2026-563216.9 Medium
- cap-go capgoCapgo - Deleted Bundle Selection via Missing Deletion Filter in /updates EndpointCVE-2026-563147.1 High
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPCCVE-2026-563116.9 Medium
- cap-go capgoCapgo - Subkey Enforcement Bypass via x-limited-key-id Header ParsingCVE-2026-563065.3 Medium
- cap-go capgoCapgo - Denial of Service via Unlimited Demo App CreationCVE-2026-562555.3 Medium
- cap-go capgoCapgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload EndpointCVE-2026-562996.9 Medium
- cap-go capgoCapgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPCCVE-2026-562538.7 High
- cap-go capgoCapgo - Privilege Escalation via Broken Row Level Security in org_usersCVE-2026-562517.0 High
- cap-go capgoCapgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCCVE-2026-562428.7 High
- cap-go capgoCapgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overageCVE-2026-562397.2 High
- cap-go capgoCapgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logsCVE-2026-562297.1 High
- cap-go capgoCapgo - Open Redirect via confirmation_url ParameterCVE-2026-563325.1 Medium
- cap-go capgoCapgo - Open Redirect via Unvalidated Stripe Billing URLsCVE-2026-563304.8 Medium
- cap-go capgoCapgo - App Existence Oracle via GET /statistics/app/:app_idCVE-2026-563195.3 Medium
- cap-go capgoCapgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API KeysCVE-2026-562955.3 Medium
- cap-go capgoCapgo - Information Disclosure via Unauthenticated /replication EndpointCVE-2026-562826.9 Medium
- cap-go capgoCapgo - Denial of Service via Improper Password Policy Length ValidationCVE-2026-562286.9 Medium
- cap-go capgoCapgo - Server-Side Request Forgery via Webhook URL ValidationCVE-2026-562275.3 Medium
- cap-go capgoCapgo - EXIF Metadata Exposure via Image UploadCVE-2026-562186.9 Medium
- cap-go capgoCapgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain LookupCVE-2026-563252.3 Low
- cap-go capgoCapgo - Scope Escalation via API Key Creation in /functions/v1/apikeyCVE-2026-562168.7 High
- cap-go capgoCapgo - Account Merge via Poisoned public.users.email in SSO ProvisioningCVE-2026-562158.7 High
- cap-go capgoCapgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCCVE-2026-562148.7 High
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPCCVE-2026-562136.9 Medium
- cap-go capgoCapgo - Improper 2FA Enforcement Logic via Team Security SettingsCVE-2026-562125.1 Medium
- cap-go capgoCapgo - Cross-Tenant Authorization Bypass via PostgREST Webhook AccessCVE-2026-560797.1 High
- cap-go capgoCapgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and DeletionCVE-2026-538688.7 High
- cap-go capgoCapgo < 12.128.2 - Orphaned File Retention via Profile Image ReplacementCVE-2026-538675.3 Medium
- capgo cliCapgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential OperationsCVE-2026-56236Fix available6.8 Medium