CVE-2026-100629 | Medium | 5.5 | 2026-09-26 | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that th… |
CVE-2026-100628 | Medium | 4.3 | 2026-09-26 | capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, reques… |
CVE-2026-100627 | High | 8.1 | 2026-09-26 | Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoi… |
CVE-2026-100626 | Medium | 4.3 | 2026-09-26 | capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage… |
CVE-2026-100625 | High | 7.1 | 2026-09-26 | Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build… |
CVE-2026-100624 | Medium | 5.4 | 2026-09-26 | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request i… |
CVE-2026-100623 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org… |
CVE-2026-100622 | High | 7.5 | 2026-09-26 | capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers c… |
CVE-2026-100621 | Medium | 4.3 | 2026-09-26 | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication… |
CVE-2026-100620 | Low | 3.8 | 2026-09-26 | Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Googl… |
CVE-2026-100619 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed… |
CVE-2026-100618 | High | 8.5 | 2026-09-26 | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalize… |
CVE-2026-100617 | High | 8.8 | 2026-09-26 | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant c… |
CVE-2026-100616 | Medium | 5.5 | 2026-09-26 | capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table… |
CVE-2026-100615 | High | 8.8 | 2026-09-26 | Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super… |
CVE-2026-100614 | High | 8.8 | 2026-09-26 | Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows… |
CVE-2026-100613 | Medium | 5.3 | 2026-09-26 | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of p… |
CVE-2026-100612 | High | 7.2 | 2026-09-26 | Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers… |
CVE-2026-100611 | Medium | 6.5 | 2026-09-26 | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When a… |
CVE-2026-88864 | Critical | 9.1 | 2026-09-10 | Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo ful… |
CVE-2026-88863 | High | 8.1 | 2026-09-10 | capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of… |
CVE-2026-88862 | High | 8.8 | 2026-09-10 | Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/… |
CVE-2026-88861 | High | 8.3 | 2026-09-10 | Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization… |
CVE-2026-88860 | Medium | 6.3 | 2026-09-10 | Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can ret… |
CVE-2026-56339 | High | 7.5 | 2026-07-15 | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_in… |
CVE-2026-56296 | Medium | 5.3 | 2026-07-11 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existi… |
CVE-2026-56284 | Medium | 5.3 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id)… |
CVE-2026-56226 | High | 7.5 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the… |
CVE-2026-56310 | Medium | 4.3 | 2026-06-24 | Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limi… |
CVE-2026-56245 | High | 8.2 | 2026-06-24 | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticate… |
CVE-2026-56248 | High | 7.5 | 2026-06-23 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Securit… |
CVE-2026-56280 | High | 7.1 | 2026-06-22 | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native bu… |
CVE-2026-56221 | Medium | 6.5 | 2026-06-22 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated d… |
CVE-2026-56316 | Medium | 5.3 | 2026-06-21 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to… |
CVE-2026-56307 | Medium | 4.3 | 2026-06-20 | Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authentic… |
CVE-2026-56235 | Medium | 5.3 | 2026-06-20 | Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metri… |
CVE-2026-56082 | High | 7.5 | 2026-06-19 | Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time… |
CVE-2026-56081 | Critical | 9.1 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before tha… |
CVE-2026-56080 | Medium | 4.9 | 2026-06-19 | Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to… |
CVE-2026-56073 | Critical | 9.4 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying serv… |
CVE-2026-53867 | Medium | 4.3 | 2026-06-12 | Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned… |
CVE-2026-53982 | Medium | 6.5 | 2026-06-12 | Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding… |
CVE-2026-53981 | High | 7.6 | 2026-06-12 | Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session… |